CVE-2002-1385
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code...
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
Exploit likelihood
What each source reports
NVD Score used
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
- Record
CVE-2002-1385- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
- Record
CVE-2002-1385- Updated
- 2026-11-02
EUVDEUVD-2002-1369 No score
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
- Record
EUVD-2002-1369- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r6hq-58j4-9342 No score
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code...
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
- Record
GHSA-r6hq-58j4-9342- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2002-1385 is a high vulnerability (CVSS 7.2) in Open Webmail Webmail, published December 26, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. No source names a fixed version.
References
securityfocus.com/bid/6425
marc.info?l=bugtraq&m=104032263328026&w=2
sourceforge.net/forum/forum.php?thread_id=782605&forum_id=108435
exchange.xforce.ibmcloud.com/vulnerabilities/10904
nvd.nist.gov/vuln/detail/CVE-2002-1385
github.com/advisories/GHSA-r6hq-58j4-9342