CVE-2019-12938 - The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx

Back Back to CVE browser

MEDIUM

The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx

Published Jun 24, 2019

4.3

MEDIUM

CVSS 3.0

EPSS 1.01%

Description

The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-693

References (3)

https://bitbucket.org/analogic/mailserver/issues/665/posteio-logs-leak
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4514
Advisory
https://poste.io/changelog
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://bitbucket.org/analogic/mailserver/issues/665/posteio-logs-leak		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4514		Advisory
https://poste.io/changelog		x_refsource_MISCRelease NotesVendor Advisory