CVE-2011-0063

The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the "extra" parameter to the help command, which causes the regular expression to produce .. (dot dot) sequences. NOTE: this vulnerability is due to an incomplete fix for CVE-2011-0049.

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

85.45% chance of exploitation in the next 30 days, 100th percentile

Published

2011-03-15

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/16103

References

• CVE Record
• NVD entry

Related

• CVE-2011-0049
• CVE-2011-0065
• CVE-2011-0045
• CVE-2011-0070
• CVE-2011-0041
• CVE-2011-0071