Detections
Analytics

Atrium MERCUR Mailserver Local Traversal Arbitrary File Access

medium Nessus Network Monitor Plugin ID 1089

Synopsis

The remote system is vulnerable to an information disclosure flaw.

Description

The remote IMAP server is Mercur Mailserver 3.20. There is a flaw in this server (present up to version 3.20.02) which allows any authenticated user to read any file on the system. This includes other users mailboxes, or any system file. Warning : this flaw has not been actually checked but was deduced from the server banner.

Solution

There was no solution ready when this vulnerability was written; Please contact the vendor for updates that address this vulnerability.

See Also

http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0057.html

Plugin Details

Severity: Medium

ID: 1089

Family: IMAP Servers

Published: 8/20/2004

Updated: 3/6/2019

Nessus ID: 10382

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:X

Vulnerability Information

CPE: cpe:/a:atrium_software:mercur_mailserver

Reference Information

CVE: CVE-2000-0318

BID: 1144