CVE-2010-1132

The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.

CVSS v2.0 NVD

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

8.55% chance of exploitation in the next 30 days, 95th percentile

Published

2010-03-26

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/11662

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/11662

Security advisories

• http://secunia.com/advisories/38840
• http://secunia.com/advisories/38956
• http://secunia.com/advisories/39265
• http://www.vupen.com/english/advisories/2010/0559
• http://www.vupen.com/english/advisories/2010/0683
• http://www.vupen.com/english/advisories/2010/0837
• http://www.securityfocus.com/bid/38578

References

• CVE Record
• NVD entry