CVE-2002-1385
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code...
CVE-2002-1385 is a high vulnerability (CVSS 7.2) in Open Webmail Webmail, published December 26, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. No source names a fixed version.
- Severity
- 7.2 HighCVSS 2.0, NVD
- Exploit chance
- 0.41%EPSS, 35th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
Exploit likelihood
Affected products
What each source reports
NVD Score used
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
- Record
CVE-2002-1385- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
- Record
CVE-2002-1385- Updated
- 2026-11-02
EUVDEUVD-2002-1369No score
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
- Record
EUVD-2002-1369- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r6hq-58j4-9342No score
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code...
openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.
- Record
GHSA-r6hq-58j4-9342- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/6425
marc.info?l=bugtraq&m=104032263328026&w=2
sourceforge.net/forum/forum.php?thread_id=782605&forum_id=108435
exchange.xforce.ibmcloud.com/vulnerabilities/10904
nvd.nist.gov/vuln/detail/CVE-2002-1385
github.com/advisories/GHSA-r6hq-58j4-9342