PT-2011-4977 · Hastymail · Hastymail2

Publicado 2011-11-30 · Atualizado 2018-01-06 · CVE-2011-4542

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hastymail2 version 2.1.1 before RC2

Description The issue allows remote attackers to execute arbitrary commands. This can be achieved via the rs or rsargs[] parameter in a mailbox Drafts action to the default URI.

Recommendations For Hastymail2 version 2.1.1 before RC2, consider updating to RC2 or a later version to resolve the issue. As a temporary workaround, restrict access to the mailbox Drafts action and avoid using the rs and rsargs[] parameters in the default URI until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2011-4542

Produtos afetados

Hastymail2

Referências · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/hastymail_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/19758 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4542 · Nota de Segurança
• https://dognaedis.com/vulns/DGS-SEC-3.html · Nota
• http://secunia.com/advisories/48308 · Nota