Detections
Analytics

Open Webmail < 2.51 20050430 Shell Escape Arbitrary Command Execution

high Nessus Network Monitor Plugin ID 2875

Synopsis

The remote host is vulnerable to an flaw that allows attackers to execute arbitrary commands.

Description

The remote host is running Open Webmail, an open-source perl script that gives remote users a web-based interface to email. This version of Open Webmail is vulnerable to a content-parsing flaw that would allow a remote attack to run arbitrary code on the Open Webmail server. Specifically, the application fails to parse out the '|' character which can be used to append commands to system calls.

Solution

Upgrade to version 2.51 20050430 or higher.

See Also

http://www.nessus.org/u?e789a315

Plugin Details

Severity: High

ID: 2875

Family: CGI

Published: 5/3/2005

Updated: 3/6/2019

Nessus ID: 18190

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:open_webmail:open_webmail

Reference Information

CVE: CVE-2005-1435, CVE-2006-3233

BID: 13472, 18598