Unscored severity · published Feb 4, 2011
CVE-2011-0049
Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via
–
CVSS
95.4%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.
Exploitation
Is it being used?
Exploit prediction (EPSS)95.4% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M2
Majordomo 2 · Mj2
through 20110130; 20110101; 20110102; 20110103; 20110104; 20110105; +24 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0049
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0049
osvdb.org
http://osvdb.org/70762
Vendor Advisory
http://secunia.com/advisories/43125
securityreason.com
http://securityreason.com/securityalert/8061
www.exploit-db.com
http://www.exploit-db.com/exploits/16103
US Government Resource
http://www.kb.cert.org/vuls/id/363726
www.securityfocus.com
http://www.securityfocus.com/archive/1/516150/100/0/threaded
More from Majordomo 2
–
CVE-2011-0063
The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a…