PT-2025-32399 · Unknown · E-Mail Security Virtual Appliance

CVE-2012-10046 · Publicado 2025-08-08 · Atualizado 2025-08-08

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: E-Mail Security Virtual Appliance (ESVA) version ESVA 2057

Description: The E-Mail Security Virtual Appliance (ESVA) contains an unauthenticated command injection issue in the learn-msg.cgi script. The CGI handler does not properly sanitize user-supplied input provided through the id parameter, which allows attackers to inject arbitrary shell commands. Exploitation does not require authentication and results in full command execution on the underlying system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2012-10046

Produtos afetados

E-Mail Security Virtual Appliance

Referências · 7

• https://sourceforge.net/projects/esva-project · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-10046 · Nota de Segurança
• https://exploit-db.com/exploits/20551 · Nota
• https://t.me/CVEtracker/29537 · Publicação no Telegram
• https://exploit-db.com/exploits/20712 · Nota
• https://vulncheck.com/advisories/email-security-virtual-appliance-command-injection · Nota
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/esva_exec.rb · Nota