CVE-2006-6131

Severity: medium (CVSS 6.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-11-28 · updated 2026-06-16

Description

Untrusted search path vulnerability in (1) WSAdminServer and (2) WSWebServer in Kerio WebSTAR (4D WebSTAR Server Suite) 5.4.2 and earlier allows local users with webstar privileges to gain root privileges via a malicious libucache.dylib helper library in the current working directory.

Affected products

Kerio Webstar: through 5.4.2; 4.0, 5.1.2, 5.1.3, 5.2, 5.2.1, 5.2.2 (+8)

References

http://secunia.com/advisories/22906
http://securityreason.com/securityalert/1921
http://securitytracker.com/id?1017239
http://www.digitalmunition.com/DMA%5B2006-1115a%5D.txt
http://www.osvdb.org/30450
http://www.securityfocus.com/archive/1/451832/100/200/threaded
http://www.securityfocus.com/bid/21123
http://www.vupen.com/english/advisories/2006/4539
https://exchange.xforce.ibmcloud.com/vulnerabilities/30308
http://secunia.com/advisories/22906
http://securityreason.com/securityalert/1921
http://securitytracker.com/id?1017239

Get alerted when CVE-2006-6131 or the next vulnerability affects your stack