CVE-2001-1044

CVE-2001-1044 describes a critical vulnerability in Basilix Webmail 0.9.7beta and potentially other versions, where sensitive files like *.class and *.inc are stored under the web document root without access restrictions. This allows unauthenticated remote attackers to directly access these files, potentially exposing confidential information such as MySQL usernames and passwords. The vulnerability carries a CVSS score of 7.5 (HIGH), indicating a severe risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score of 92/100 further emphasizes its high criticality. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an exploit (EDB-20538) demonstrating incorrect file permissions exists on ExploitDB. Despite its age, the lack of community discussion or media coverage is typical for many CVEs, but the presence of a public exploit indicates its potential for abuse.