CVE-2002-1385: openwebmail_init in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via ..

Security readout for executives and security teams

This is an old Open WebMail code execution issue. The CVE says Open WebMail 1.81 and earlier can let a local user abuse path traversal in a login name to load a configuration file that triggers additional code execution. Treat any remaining deployment as legacy high risk until verified remediated. Exposure is most likely in legacy Open WebMail installations, especially systems still running version 1.81 or earlier. The CVE text says local users are required, while referenced Bugtraq titles mention remote root compromise for 1.71; the source bundle does not resolve that discrepancy. Prioritize if Open WebMail is still present. This is legacy software with code execution impact and incomplete modern scoring, so business risk depends on whether any exposed or multi-user system still runs the affected versions. Mitigation focus: Identify any Open WebMail deployments and record exact versions.; Retire or isolate Open WebMail 1.81 and earlier where possible.; Check archived vendor or project guidance for the named fix..

Prepared

Jun 30, 2026, 03:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.