Robin François has discovered a security issue in IceWarp Mail Server, which can be exploited by malicious people to disclose certain system information.

The security issue is caused due to a PHP script (webmail/pda/controller/raw.php) within the WebMail component displaying PHP configuration via "phpinfo()" function without prior authentication.

The security issue is confirmed in version 10.4.3. Other versions may also be affected.

Solution
The vendor recommends to remove the "raw.php" script.

Provided and/or discovered by
Robin François, Navixia via Secunia.

Deep Links
Links available to Secunia VIM customers