Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2019-12938

Description

The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI.

POC

Reference

- https://bitbucket.org/analogic/mailserver/issues/665/posteio-logs-leak

Github

No PoCs found on GitHub currently.