CVE-2012-1918

Name of the Vulnerable Software and Affected Versions AtMail Open-Source versions prior to 1.05

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities are located in the compose.php and libs/Atmail/SendMsg.php files of the @Mail WebMail Client in AtMail Open-Source. Remote attackers can exploit this issue by using a .. (dot dot) in the Attachment[] parameter to read arbitrary files.

Recommendations For versions prior to 1.05, update to version 1.05 or later to resolve the issue. As a temporary workaround, consider restricting access to the compose.php and libs/Atmail/SendMsg.php files to minimize the risk of exploitation. Avoid using the Attachment[] parameter in affected API endpoints until the issue is resolved.