Vulnerability Details CVE-2008-0946
Directory traversal vulnerability in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to create arbitrary empty files via a .. (dot dot) in the recipient field.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 18.3%
CVSS Severity
CVSS v2 Score 4.9
References
- http://aluigi.altervista.org/adv/ipsimene-adv.txt
- http://aluigi.org/poc/ipsimene.zip
- http://securityreason.com/securityalert/3697
- http://www.securityfocus.com/archive/1/487748/100/200/threaded
- http://www.securityfocus.com/bid/27677
- http://aluigi.altervista.org/adv/ipsimene-adv.txt
- http://aluigi.org/poc/ipsimene.zip
- http://securityreason.com/securityalert/3697
- http://www.securityfocus.com/archive/1/487748/100/200/threaded
- http://www.securityfocus.com/bid/27677
Products affected by CVE-2008-0946
-
cpe:2.3:a:ipswitch:imserver:2.0.5.30
-
cpe:2.3:a:ipswitch:imserver:2.0.8.1
-
cpe:2.3:a:ipswitch:instant_messaging:2.0
-
cpe:2.3:a:ipswitch:instant_messaging:2.0.8.1