CVE-2005-0313 describes multiple directory traversal vulnerabilities in Magic Winmail Server 4.0 Build 1112. These flaws allow remote attackers to upload arbitrary files via upload.php or read arbitrary files via download.php. Additionally, authenticated users can manipulate arbitrary files and directories through IMAP commands. The vulnerability has a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low complexity, and potential for partial compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score of 96/100 further emphasizes its critical nature. While not listed on the KEV catalog, exploit code is publicly available on ExploitDB for both arbitrary file upload and arbitrary file access. Community discussion is notably high, with 10 mentions, suggesting significant attention despite no active exploitation reports or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.0CPE matchmatch criteria | cpe:2.3:a:amax_information_technologies:magic_winmail_server:4.0:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.