VDB
CVE-2010-1132
CVE-2010-1132
PUBLISHED
CVSS 9.300000190734863 CRITICAL
The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.
EPSS 8.55% · 95.0th percentile
Risk Scores
CVSS 2.0
9.300000190734863
EPSS Score
8.55%
95.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| georg_greve | spamassassin_milter_plugin | 0.3.1 |
Timeline
- Mar 9, 2010 PoC Published
- Mar 26, 2010 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Feb 10, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 4, 2023 EPSS Score
- Jul 19, 2023 EPSS Score
References
- DSA-2021 vendor-advisory
- FEDORA-2010-5096 vendor-advisory
- 62809 vdb
- ADV-2010-0559 vdb
- 39265 third-party-advisory
- 11662 exploit
- 38840 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2010-1132 advisory
- https://savannah.nongnu.org/bugs/?29136 url
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038572.html url
- http://secunia.com/advisories/38956 url
- http://www.securitytracker.com/id?1023691 url
- http://www.vupen.com/english/advisories/2010/0683 url
- http://www.vupen.com/english/advisories/2010/0837 url
- http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html exploit
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038777.html technical
- https://bugzilla.redhat.com/show_bug.cgi?id=572117 technical
- http://bugs.debian.org/573228 technical
- http://www.securityfocus.com/bid/38578 exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56732 technical