How severe is CVE-2006-2917?

CVE-2006-2917 has a CVSS 2.0 base score of 5.5, rated medium severity.

Is CVE-2006-2917 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2006-2917?

CVE-2006-2917 primarily affects Qbik Wingate. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2006-2917?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2006-2917 published?

CVE-2006-2917 was published on 2006-07-10 and last updated on 2026-06-16.

CVE-2006-2917

CVE-2006-2917 is a medium-severity vulnerability in Qbik Wingate with a CVSS 2.0 base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 5.5)
EPSS exploit prediction: 1% (69th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Qbik Wingate
Published: 2006-07-10
Last modified: 2026-06-16

Description

Directory traversal vulnerability in the IMAP server in WinGate 6.1.2.1094 and 6.1.3.1096, and possibly other versions before 6.1.4 Build 1099, allows remote authenticated users to read email of other users, or perform unauthorized operations on directories, via the (1) CREATE, (2) SELECT, (3) DELETE, (4) RENAME, (5) COPY, (6) APPEND, and (7) LIST commands.

Frequently asked questions

What is CVE-2006-2917?: Directory traversal vulnerability in the IMAP server in WinGate 6.1.2.1094 and 6.1.3.1096, and possibly other versions before 6.1.4 Build 1099, allows remote authenticated users to read email of other users, or perform unauthorized operations on directories, via the (1) CREATE, (2) SELECT, (3) DELETE, (4) RENAME, (5) COPY, (6) APPEND, and (7) LIST commands.
How severe is CVE-2006-2917?: CVE-2006-2917 has a CVSS 2.0 base score of 5.5, rated medium severity.
Is CVE-2006-2917 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2006-2917?: CVE-2006-2917 primarily affects Qbik Wingate. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2006-2917?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2006-2917 published?: CVE-2006-2917 was published on 2006-07-10 and last updated on 2026-06-16.

References

Affected products (2)

cpe:2.3:a:qbik:wingate:6.1.2.1094:*:*:*:*:*:*:*
cpe:2.3:a:qbik:wingate:6.1.3.1096:*:*:*:*:*:*:*

More vulnerabilities in Qbik Wingate

CVE-2020-13866 — High (CVSS 7.8): WinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows local users to gain…
CVE-2006-2926 — High (CVSS 7.5): Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a…
CVE-1999-0291 — High (CVSS 7.5): The WinGate proxy is installed without a password, which allows remote attackers to redirect connections without…
CVE-2008-3606 — Medium (CVSS 6.5): Heap-based buffer overflow in the IMAP service in Qbik WinGate 6.2.2.1137 and earlier allows remote authenticated users…
CVE-2009-0802 — Medium (CVSS 5.4): Qbik WinGate, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote…
CVE-2007-4335 — Medium (CVSS 5.0): Format string vulnerability in the SMTP server component in Qbik WinGate 5.x and 6.x before 6.2.2 allows remote…

All CVEs affecting Qbik Wingate →