CVE-2008-3060 Information disclosure in n/a
Remote attackers can obtain sensitive installation path information via malformed login input or invalid session IDs in V-webmail.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-3060?
CVE-2008-3060 is a medium-severity vulnerability in n/a, published on 7 Oct 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
V-webmail 1.5.0 allows remote attackers to obtain sensitive information via (1) malformed input in the login page (includes/local.hooks.php) and (2) an invalid session ID, which reveals the installation path in an error message.
Weakness: CWE-200
Which versions are affected by CVE-2008-3060?
It affects 1 product.
Products include V-Webmail V-Webmail.
How do I fix CVE-2008-3060?
No fix has been published for CVE-2008-3060 yet. Limit exposure of the affected software until one is available.
Is CVE-2008-3060 being exploited?
There is no known exploitation of CVE-2008-3060 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5q5f-4v35-9pq8.