CVE-2002-1782 Path traversal in n/a
Local users with valid IMAP accounts can read arbitrary files due to default configuration flaws in the University of Washington IMAP daemon.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2002-1782?
CVE-2002-1782 is a low-severity path traversal vulnerability in n/a, published on 21 Jun 2005. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The default configuration of University of Washington IMAP daemon (wu-imapd), when running on a system that does not allow shell access, allows a local user with a valid IMAP account to read arbitrary files as that user.
Which versions are affected by CVE-2002-1782?
It affects 1 product.
Products include University of Washington Uw-Imap.
How do I fix CVE-2002-1782?
Change a configuration setting.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2002-1782 being exploited?
There is no known exploitation of CVE-2002-1782 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2002-1782, GHSA-mrc9-g9w2-j5g5.