PT-2011-2045 · Great Circle Associates · Majordomo

CVE-2011-0049 · Publicado 2011-02-04 · Atualizado 2024-02-14

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Majordomo versions prior to 20110131

Description The issue allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command. This can be achieved by sending a crafted email or by exploiting the web interface, specifically the cgi-bin/mj wwwusr endpoint.

Recommendations For versions prior to 20110131, update to version 20110131 or later to resolve the issue. As a temporary workaround, consider restricting access to the help command and the cgi-bin/mj wwwusr endpoint in the web interface until the update is applied.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2011-0049

Produtos afetados

Majordomo

Referências · 16

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/majordomo2_directory_traversal.rb · Exploit
• 🔥 http://securityfocus.com/bid/46127 · Exploit
• 🔥 https://sitewat.ch/en/Advisory/View/1 · Exploit
• 🔥 http://exploit-db.com/exploits/16103 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=628064 · Exploit
• 🔥 https://exploit-db.com/exploits/16103 · Exploit
• http://secunia.com/advisories/43125 · Aviso do Fabricante
• http://securityfocus.com/archive/1/516150/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65113 · Nota
• http://kb.cert.org/vuls/id/363726 · Nota
• http://vupen.com/english/advisories/2011/0288 · Nota
• http://securityreason.com/securityalert/8061 · Nota
• http://securitytracker.com/id?1025024 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0049 · Nota de Segurança
• https://bug628064.bugzilla.mozilla.org/attachment.cgi?id=506481 · Correção