CVE-2002-2410: openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates d...

Security readout for executives and security teams

Open WebMail 1.7 and 1.71 could disclose whether a username exists and expose configuration or version details through error responses. This does not by itself give account access, but it can help attackers focus password guessing or plan follow-on attacks against exposed mail systems. Exposure is most likely where Open WebMail 1.7 or 1.71 is still deployed, especially if openwebmail.pl is reachable from the internet. The bundle does not identify CPEs, packaged distributions, or downstream vendor products. Treat this as a targeted exposure-reduction item for legacy mail systems, not an emergency unless Open WebMail is internet-facing or tied to sensitive accounts. Prioritize inventory and retirement or vendor-guided remediation. Mitigation focus: Inventory systems for Open WebMail 1.7 and 1.71 installations.; Check Open WebMail vendor or maintainer guidance for fixed versions or configuration changes.; Restrict public access to openwebmail.pl until exposure is understood..

Prepared

Jun 29, 2026, 01:47 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.