Unscored severity · published Feb 25, 2008
CVE-2008-0946
Directory traversal vulnerability in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to create…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to create arbitrary empty files via a .. (dot dot) in the recipient field.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Imserver · Ipswitch
through 2.0.8.1 · source: NVD
IM
Instant Messaging · Ipswitch
through 2.0.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0946
Exploit
http://aluigi.altervista.org/adv/ipsimene-adv.txt
Exploit
http://aluigi.org/poc/ipsimene.zip
securityreason.com
http://securityreason.com/securityalert/3697
www.securityfocus.com
http://www.securityfocus.com/archive/1/487748/100/200/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/27677
More from Imserver
–
CVE-2008-0945
Format string vulnerability in the logging function in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated…
–
CVE-2007-3959
The IM Server (aka IMserve or IMserver) 2.0.5.30 and probably earlier in Ipswitch Instant Messaging before 2.07 in Ipswitch Collaboration Suite (ICS) allows remote attackers to…