CVE-2008-2937

Summary

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name. Please refer to the following links for additional version information (vendor release notes): Postfix 2.5 - ftp://mirrors.loonybin.net/pub/postfix/official/postfix-2.5.4.RELEASE_NOTES Postfix 2.6 - ftp://mirrors.loonybin.net/pub/postfix/experimental/postfix-2.6-20080814.RELEASE_NOTES

Technical Details

CVSSv2 Score:

1.9

CWE ID:

CWE-200

Published Date:

Monday 18th of August 2008

Modified Date:

Thursday 11th of October 2018

CVSSv2 Score:
  • Access Vector: Local
  • Access Complexity: Medium
  • Authentication Required: None
  • Confidentiality Impact: Partial
  • Integrity Impact: None
  • Availability Impact: None
Common Platform Enumeration (CPE) Affected: Common Platform Enumeration (CPE) List:

Reference: Find your Vulnerabilities:

Find out if you have vulnerabilities exposing you to hackers and malware: Download Mageni's Free Edition

Keyword Search

Search CVEs, Products and Vendors.

Don't pay for a vulnerability scanning and management platform. This one is free.

Mageni provides a free vulnerability scanning and management platform which helps you need to find, prioritize, remediate and manage your vulnerabilities.