CVE-2002-2165 Information disclosure in n/a
An attacker can read another user's inbox by exploiting an error page that leaks the REFERER header from a previous login session.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2002-2165?
CVE-2002-2165 is a low-severity vulnerability in n/a, published on 16 Nov 2005. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The IMHO Webmail module 0.97.3 and earlier for Roxen leaks the REFERER from the browser's previous login session in an error page, which allows local users to read another user's inbox.
Which versions are affected by CVE-2002-2165?
It affects 1 product.
Products include Imho Imho Webmail.
How do I fix CVE-2002-2165?
No fix has been published for CVE-2002-2165 yet. Limit exposure of the affected software until one is available.
Is CVE-2002-2165 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2002-2165 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-9rg7-64p7-vcr7.