CVE-2010-5335

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-11 · updated 2026-06-16
Weakness: CWE-22

Description

IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (script to basic/minimizer/index.php) is not properly sanitised and can therefore be exploited to browse the partition where IceWarp is installed (or the whole system) and read arbitrary files.

Affected products

IceWarp Webclient: from 10.0 before 10.2.1 — fixed in 10.2.1

How to fix

Upgrade to a fixed version: IceWarp Webclient 10.2.1. Check the vendor advisory for mitigations.

References

https://vuldb.com/?id.142994
https://www.gosecurity.ch/fachartikel/168-gosecurity-advisory-2010120601
https://vuldb.com/?id.142994
https://www.gosecurity.ch/fachartikel/168-gosecurity-advisory-2010120601

Get alerted when CVE-2010-5335 or the next vulnerability affects your stack