CVE-2000-0911

Medium

Published: 19/12/2000(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.86%

78th percentile - higher than 78% of all known CVEs

Summary

IMP 2.2 and earlier allows attackers to read and delete arbitrary files by modifying the attachment_name hidden form variable, which causes IMP to send the file to the attacker as an attachment.

Risk Assessment

Possible unauthorized reading and deletion of files on the server, which may lead to data loss and disclosure of sensitive information.

Recommendation

Update IMP to a version newer than 2.2 or apply a patch; restrict access to the application and validate processing of the attachment_name variable.

Other vulnerabilities in IMP

CVE-2000-0459Medium
IMP does not remove files properly if the MSWordView application quits, allowing local users to cause a denial of service by filling up disk space by requesting a large number of documents and prematurely stopping the request.

Original NVD description (English source)

IMP 2.2 and earlier allows attackers to read and delete arbitrary files by modifying the attachment_name hidden form variable, which causes IMP to send the file to the attacker as an attachment.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS