Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) ..…

published 2018-05-08 8 y ago modified 2026-06-17 4 mo ago also EUVD-2015-1637

cvss: 7.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 57.0%; EPSS 57.0% chance of exploitation in 30 days, percentile 99%
public exploits: 1; Exploit-DB, plus a Nuclei check

Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php.

Patch / fix

fixed in 1

icewarp mail_server 11.2.0

Timeline

2018-05-04 First public exploit (EDB-44587)
2018-05-08 Published

Exploit prediction

57.01% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-44587 IceWarp Mail Server < 11.1.1 - Directory Traversal webapps, 2018-05-04
Nuclei template IceWarp Mail Server <11.1.1 - Directory Traversal nuclei detection template
trustwave.com https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-001/?fid=5614 referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/147505/IceWarp-Mail-Server-Directory-Traversal.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	7.8	AV:N/AC:L/Au:N/C:C/I:N/A:N

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

exploit-db.com /exploits/44587/
exploit, third-party-advisory, vdb-entry
trustwave.com /Resources/Security-Advisories/Advisories/TWSL2015-001/?fid=5614
exploit, third-party-advisory
packetstormsecurity.com /files/147505/IceWarp-Mail-Server-Directory-Traversal.html
exploit, third-party-advisory, vdb-entry

Sources

CVE List CVE-2015-1503
NVD CVE-2015-1503

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary