Information disclosure in Roundcube Webmail

CVE-2005-4368

roundcube webmail Alpha, with a default high verbose level ($rcmail_config['debug_level'] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message.

Vulnerability class: Information Disclosure

EPSS: 0.014 (69.9th percentile) — read the EPSS interpretation.

Affected products

Roundcube Webmail
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)