Unscored severity · published Dec 31, 2002
CVE-2002-2410
openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote…
–
CVSS
1.3%
EPSS
No
On KEV
Description
openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OW
Open Webmail · Open Webmail
1.7; 1.71 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-2410
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-2410
Exploit
http://archives.neohapsis.com/archives/bugtraq/2002-11/0278.html
www.iss.net
http://www.iss.net/security_center/static/10684.php
www.securityfocus.com
http://www.securityfocus.com/bid/6232
More from Open Webmail
–
CVE-2007-4172
Multiple cross-site scripting (XSS) vulnerabilities in Open Webmail (OWM) 2.52 20060831 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1)…
–
CVE-2006-3233
Cross-site scripting (XSS) vulnerability in openwebmail-read.pl in Open WebMail (OWM) 2.52, and other versions released before 06/18/2006, allows remote attackers to inject…
–
CVE-2006-3229
Cross-site scripting (XSS) vulnerability in Open WebMail (OWM) 2.52, and other versions released before 05/12/2006, allows remote attackers to inject arbitrary web script or HTML…
–
CVE-2006-2190
Cross-site scripting (XSS) vulnerability in ow-shared.pl in OpenWebMail (OWM) 2.51 and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionid…
–
CVE-2005-2863
Cross-site scripting (XSS) vulnerability in openwebmail-main.pl in OpenWebMail 2.41 allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter