PT-2011-4977 · Hastymail · Hastymail2

Published 2011-11-30 · Updated 2018-01-06 · CVE-2011-4542

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hastymail2 version 2.1.1 before RC2

Description The issue allows remote attackers to execute arbitrary commands. This can be achieved via the rs or rsargs[] parameter in a mailbox Drafts action to the default URI.

Recommendations For Hastymail2 version 2.1.1 before RC2, consider updating to RC2 or a later version to resolve the issue. As a temporary workaround, restrict access to the mailbox Drafts action and avoid using the rs and rsargs[] parameters in the default URI until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2011-4542

Affected Products

Hastymail2

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/hastymail_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/19758 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4542 · Security Note
• https://dognaedis.com/vulns/DGS-SEC-3.html · Note
• http://secunia.com/advisories/48308 · Note