Security readout for executives and security teams
The PostACI webmail application stored a sensitive configuration file inside the public web folder. Anyone on the internet could request that file directly in a browser and read database usernames and passwords. That gave attackers the keys to the mailbox database without needing to break in. Exposure today is minimal. PostACI is a legacy webmail package and the CVE dates to 2000. Any surviving deployment on an internet-facing host with the default include path would still leak credentials to unauthenticated web requests. No CPE or vendor product mapping is provided in the source bundle. Low priority for most modern environments because PostACI is legacy software rarely deployed today. If any PostACI instance still exists in the estate, treat as high urgency: exposed credentials are a direct path to mailbox and database compromise. Confirm inventory, then decommission or reconfigure. Mitigation focus: Move global.inc and other include files outside the web-served document root.; Deny web access to .inc files via server configuration until relocation is complete.; Rotate any database credentials that were stored in the exposed file..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2000-1100 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.