openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error…
Priority LOW 25CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information.
Why it matters now
EPSS 0.01309 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:open_webmail:open_webmail:1.7:*:*:*:*:*:*:* | 1.7 | Vulnerable | Open Webmail |
| cpe:2.3:a:open_webmail:open_webmail:1.71:*:*:*:*:*:*:* | 1.71 | Vulnerable | Open Webmail |
- cpe:2.3:a:open_webmail:open_webmail:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Open Webmail
- cpe:2.3:a:open_webmail:open_webmail:1.71:*:*:*:*:*:*:* Versions 1.71 Vulnerable ·Open Webmail
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2002-2410
- 2026-10-03 Alias added: GHSA-46v6-92ch-v3xp
References
More Open Webmail vulnerabilities
- TI-2004-02156 The read_list_from_file function in vacation.pl for OpenWebmail before 2.32 20040629… CVSS 2.0HIGH 10.0
- TI-2004-00469 Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows… CVSS 2.0MEDIUM 6.8
- TI-2004-00580 Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier… CVSS 2.0MEDIUM 6.8
- TI-2005-01357 Open WebMail (OWM) before 2.51 20050430 allows remote authenticated users to execute… CVSS 2.0HIGH 7.5
- TI-2006-02134 Cross-site scripting (XSS) vulnerability in ow-shared.pl in OpenWebMail (OWM) 2.51 and… CVSS 2.0MEDIUM 6.8
- TI-2002-01308 openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary… CVSS 2.0HIGH 7.2
Sources
- CVE-2002-2410 · CVE Program
- CVE-2002-2410 · NVD
- FIRST EPSS
- GHSA-46v6-92ch-v3xp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences