What’s Vulnerable › Vulnerabilities

CVE-2019-12938

• Severity: medium (CVSS 4.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-06-24 · updated 2026-06-17
• Weakness: CWE-693

Description

The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI.

Affected products

• Analogic Poste.Io: 2.1.6

References

• https://bitbucket.org/analogic/mailserver/issues/665/posteio-logs-leak
• https://poste.io/changelog
• https://bitbucket.org/analogic/mailserver/issues/665/posteio-logs-leak
• https://poste.io/changelog

Get alerted when CVE-2019-12938 or the next vulnerability affects your stack