CVE-2002-1582 - compose.cgi in Mailreader.com 2.3.30 and 2.3.31, when using Sendmail as the Mail Transfer Agent, all

CVE-2002-1582

Summary

compose.cgi in Mailreader.com 2.3.30 and 2.3.31, when using Sendmail as the Mail Transfer Agent, allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable, which is used to call Sendmail in network.cgi.

References

Vulnerable Configurations

cpe:2.3:a:mailreader.com:mailreader.com:2.3.30:*:*:*:*:*:*:*
cpe:2.3:a:mailreader.com:mailreader.com:2.3.30:*:*:*:*:*:*:*
cpe:2.3:a:mailreader.com:mailreader.com:2.3.31:*:*:*:*:*:*:*
cpe:2.3:a:mailreader.com:mailreader.com:2.3.31:*:*:*:*:*:*:*

CVSS

Base:	10.0 (as of 05-09-2008 - 20:30)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	6058
bugtraq	20021028 SCAN Associates Advisory : Multiple vurnerabilities on mailreader.com
confirm	http://www.mailreader.com/download/ChangeLog
xf	mailreader-compose-command-execution(10491)

Last major update

05-09-2008 - 20:30

Published

06-12-2004 - 05:00

Last modified

05-09-2008 - 20:30