Information disclosure in Uebimiau

CVE-2009-3199

Uebimiau Webmail 3.2.0-2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database with usernames and password hashes via a direct request for system_admin/admin.ucf.

Vulnerability class: Information Disclosure

EPSS: 0.022 (80.9th percentile) — read the EPSS interpretation.

Affected products

  • Uebimiau — versions 3.2.0-2.0
  • N/a — versions n/a

Weakness classification (CWE)

References