Read the docs
TI-2003-01036 Aliases CVE-2003-1133GHSA-m8pr-fx85-4wpw

Rit Research Labs The Bat! 1.0.11 through 2.0 creates new accounts with insecure ACLs…

Priority LOW 12Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Rit Research Labs The Bat! 1.0.11 through 2.0 creates new accounts with insecure ACLs, which allows local users to read other users' email messages.

Why it matters now

EPSS 0.00442 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:ritlabs:the_bat:1.1:*:*:*:*:*:*:*1.1Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.5:*:*:*:*:*:*:*1.5Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.011:*:*:*:*:*:*:*1.011Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.14:*:*:*:*:*:*:*1.14Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.15:*:*:*:*:*:*:*1.15Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.015:*:*:*:*:*:*:*1.015Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.17:*:*:*:*:*:*:*1.17Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.18:*:*:*:*:*:*:*1.18Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.19:*:*:*:*:*:*:*1.19Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.21:*:*:*:*:*:*:*1.21Vulnerablemaximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.011:*:*:*:*:*:*:* Versions 1.011 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.015:*:*:*:*:*:*:* Versions 1.015 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.17:*:*:*:*:*:*:* Versions 1.17 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.18:*:*:*:*:*:*:* Versions 1.18 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.19:*:*:*:*:*:*:* Versions 1.19 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.21:*:*:*:*:*:*:* Versions 1.21 Vulnerable ·maximmasiutin
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ritlabs:the_bat:1.22:*:*:*:*:*:*:*1.22Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.028:*:*:*:*:*:*:*1.028Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.029:*:*:*:*:*:*:*1.029Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.31:*:*:*:*:*:*:*1.31Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.031:*:*:*:*:*:*:*1.031Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.32:*:*:*:*:*:*:*1.32Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.032:*:*:*:*:*:*:*1.032Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.33:*:*:*:*:*:*:*1.33Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.34:*:*:*:*:*:*:*1.34Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.035:*:*:*:*:*:*:*1.035Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.35:*:*:*:*:*:*:*1.35Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.036:*:*:*:*:*:*:*1.036Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.36:*:*:*:*:*:*:*1.36Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.037:*:*:*:*:*:*:*1.037Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.39:*:*:*:*:*:*:*1.39Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.039:*:*:*:*:*:*:*1.039Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.041:*:*:*:*:*:*:*1.041Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.41:*:*:*:*:*:*:*1.41Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.42:*:*:*:*:*:*:*1.42Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.42f:*:*:*:*:*:*:*1.42fVulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.043:*:*:*:*:*:*:*1.043Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.43:*:*:*:*:*:*:*1.43Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.44:*:*:*:*:*:*:*1.44Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.45:*:*:*:*:*:*:*1.45Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.46:*:*:*:*:*:*:*1.46Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.47:*:*:*:*:*:*:*1.47Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.48:*:*:*:*:*:*:*1.48Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.49:*:*:*:*:*:*:*1.49Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.51:*:*:*:*:*:*:*1.51Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.52:*:*:*:*:*:*:*1.52Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.53d:*:*:*:*:*:*:*1.53dVulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:1.101:*:*:*:*:*:*:*1.101Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:2.0:*:*:*:*:*:*:*2.0Vulnerablemaximmasiutin
cpe:2.3:a:ritlabs:the_bat:2.0.1:*:*:*:*:*:*:*2.0.1Vulnerablemaximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.22:*:*:*:*:*:*:* Versions 1.22 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.028:*:*:*:*:*:*:* Versions 1.028 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.029:*:*:*:*:*:*:* Versions 1.029 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.31:*:*:*:*:*:*:* Versions 1.31 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.031:*:*:*:*:*:*:* Versions 1.031 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.32:*:*:*:*:*:*:* Versions 1.32 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.032:*:*:*:*:*:*:* Versions 1.032 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.33:*:*:*:*:*:*:* Versions 1.33 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.34:*:*:*:*:*:*:* Versions 1.34 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.035:*:*:*:*:*:*:* Versions 1.035 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.35:*:*:*:*:*:*:* Versions 1.35 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.036:*:*:*:*:*:*:* Versions 1.036 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.36:*:*:*:*:*:*:* Versions 1.36 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.037:*:*:*:*:*:*:* Versions 1.037 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.39:*:*:*:*:*:*:* Versions 1.39 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.039:*:*:*:*:*:*:* Versions 1.039 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.041:*:*:*:*:*:*:* Versions 1.041 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.41:*:*:*:*:*:*:* Versions 1.41 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.42:*:*:*:*:*:*:* Versions 1.42 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.42f:*:*:*:*:*:*:* Versions 1.42f Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.043:*:*:*:*:*:*:* Versions 1.043 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.43:*:*:*:*:*:*:* Versions 1.43 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.44:*:*:*:*:*:*:* Versions 1.44 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.45:*:*:*:*:*:*:* Versions 1.45 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.46:*:*:*:*:*:*:* Versions 1.46 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.47:*:*:*:*:*:*:* Versions 1.47 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.48:*:*:*:*:*:*:* Versions 1.48 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.49:*:*:*:*:*:*:* Versions 1.49 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.51:*:*:*:*:*:*:* Versions 1.51 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.52:*:*:*:*:*:*:* Versions 1.52 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.53d:*:*:*:*:*:*:* Versions 1.53d Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:1.101:*:*:*:*:*:*:* Versions 1.101 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·maximmasiutin
  • cpe:2.3:a:ritlabs:the_bat:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·maximmasiutin

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2003-1133
  2. 2026-10-03 Alias added: GHSA-m8pr-fx85-4wpw

References

—

  • TI-2006-00893 Buffer overflow in RITLabs The Bat! 3.60.07 allows remote attackers to execute arbitrary code via a long Subject field. CVSS 2.0HIGH 7.5
  • TI-2001-00391 The BAT! mail client allows remote attackers to bypass user warnings of an executable… CVSS 2.0HIGH 7.5
  • TI-2017-12946 The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack… CVSS 3.0MEDIUM 5.9
  • TI-2002-00327 The Bat! 1.53d and 1.54beta, and possibly other versions, allows remote attackers to… CVSS 2.0MEDIUM 5.0
  • TI-2001-00648 Rit Research Labs The Bat! 1.51 for Windows allows a remote attacker to cause a denial of… CVSS 2.0MEDIUM 5.0
  • TI-2006-00609 RITLabs The Bat! before 3.0.0.15 displays certain important headers from encapsulated… CVSS 2.0MEDIUM 5.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences