Published: 22/09/2010 Updated: 17/08/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 515

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote malicious users to read arbitrary files via a (1) ../ (dot dot slash), (2) %5C (encoded backslash), or (3) %255c (double-encoded backslash) in the name parameter.

Vulnerable Product	Search on Vulmon	Subscribe to Product
smartertools smartermail 7.1.3876

# Note: Fixed by the vendor in version 723925 # wwwsmartertoolscom/smartermail/releasenotes/v7aspx Vendor: smartertoolscom SmarterMail 7x (713876) | Bug : Directory Traversal, OS Command Injection, Other Critcal Vulns ######################################################################## # Vendor: smartertoolscom Smarte ...

Author: Hoyt LLC Research | xsscx | cloudscanme Identified: October 28, 2010 Vendor: SmarterTools Application: SmarterMail 7x Bug(s): Stored XSS, Reflected XSS, Directory Traversal, File Upload Parameters, OS Execution, XML Injection, LDAP Injection, DoS Patch: The Vendor has released SmarterMail Version 8 at URI wwwsmart ...

######################################################################## # Vendor: smartertoolscom SmarterMail 7x (723925) # Date: 2010-10-01 # Author : David Hoyt (sqlhacker) – Hoyt LLC # Contact : h02332@gmailcom # Home : cloudscanme # Dork : insite: SmarterMail Enterprise 72 # Bug : LDAP Injection + Cross Site Scripting (STORED) ...

SmarterMail version 7x suffers from cross site scripting, shell upload and directory traversal vulnerabilities ...

SmarterMail version 723925 suffers from a LDAP injection vulnerability ...

SmarterMail version 723925 suffers from a cross site scripting vulnerability ...

CWE-22 http://www.exploit-db.com/exploits/15048 http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html http://www.securityfocus.com/bid/43324 http://packetstormsecurity.org/1009-exploits/smartermail-traversal.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/61910 https://nvd.nist.gov https://www.exploit-db.com/exploits/15048/

CVE-2010-3486

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect