Vulnerability in Matt Wright Formhandler.cgi
CVE-1999-1051
Default configuration in Matt Wright FormHandler.cgi script allows arbitrary directories to be used for attachments, and only restricts access to the /etc/ directory, which allows remote attackers to read arbitrary files via the reply_message_attach attachment parameter.
EPSS: 0.014 (70.5th percentile) — read the EPSS interpretation.
Affected products
- Matt_wright Formhandler.cgi — versions 1.0, 2.0, 3.0
- N/a — versions n/a
References
- cve@mitre.org (Vendor Advisory, mailing-list, Exploit, x_refsource_BUGTRAQ)