|
|
| |
| A security vulnerability in Kebi-Webmail solution allows gaining of server's administration by accessing the product's administration menu (since they are not password protected by default). |
| |
Credit:
The information has been provided by Anonymous.
|
| |
Kebi Webmail solution utilizes a hidden directory to allow administrators to connect to the administrator menu. Access to the directory is allowed to anyone, no form of authentication is required. By simply accessing: http://target/a/ an outside attacker can gain access to the Kebi Webmail administration directory, and to all Kebi Webmail's internal configuration parameters.
Solution:
Prevent unauthenticated access to the administration directory by placing a username/password requirement on them. This can be done by placing an .htaccess file, or modifying the httpd.conf file to contain such a requirement.
|
|
|
|
|
|
|
|
