FKIE_CVE-2011-0049

Vulnerability from fkie_nvd - Published: 2011-02-04 01:00 - Updated: 2026-06-16 23:26
Severity
Summary
Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.
References
cve@mitre.orghttp://osvdb.org/70762
cve@mitre.orghttp://secunia.com/advisories/43125Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/8061
cve@mitre.orghttp://www.exploit-db.com/exploits/16103
cve@mitre.orghttp://www.kb.cert.org/vuls/id/363726US Government Resource
cve@mitre.orghttp://www.securityfocus.com/archive/1/516150/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/46127Exploit
cve@mitre.orghttp://www.securitytracker.com/id?1025024
cve@mitre.orghttp://www.vupen.com/english/advisories/2011/0288
cve@mitre.orghttps://bug628064.bugzilla.mozilla.org/attachment.cgi?id=506481Patch
cve@mitre.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=628064Exploit, Patch
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/65113
cve@mitre.orghttps://sitewat.ch/en/Advisory/View/1Exploit, URL Repurposed
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/70762
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43125Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8061
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/16103
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/363726US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/516150/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/46127Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1025024
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0288
af854a3a-2127-422b-91ae-364da2661108https://bug628064.bugzilla.mozilla.org/attachment.cgi?id=506481Patch
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.mozilla.org/show_bug.cgi?id=628064Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/65113
af854a3a-2127-422b-91ae-364da2661108https://sitewat.ch/en/Advisory/View/1Exploit, URL Repurposed
Impacted products
Vendor Product Version
mj2 majordomo_2 *
mj2 majordomo_2 20110101
mj2 majordomo_2 20110102
mj2 majordomo_2 20110103
mj2 majordomo_2 20110104
mj2 majordomo_2 20110105
mj2 majordomo_2 20110106
mj2 majordomo_2 20110107
mj2 majordomo_2 20110108
mj2 majordomo_2 20110109
mj2 majordomo_2 20110110
mj2 majordomo_2 20110111
mj2 majordomo_2 20110112
mj2 majordomo_2 20110113
mj2 majordomo_2 20110114
mj2 majordomo_2 20110115
mj2 majordomo_2 20110116
mj2 majordomo_2 20110117
mj2 majordomo_2 20110118
mj2 majordomo_2 20110119
mj2 majordomo_2 20110120
mj2 majordomo_2 20110121
mj2 majordomo_2 20110122
mj2 majordomo_2 20110123
mj2 majordomo_2 20110124
mj2 majordomo_2 20110125
mj2 majordomo_2 20110126
mj2 majordomo_2 20110127
mj2 majordomo_2 20110128
mj2 majordomo_2 20110129
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "17911370-2B86-44EB-9523-A4B4C3EBC823",
              "versionEndIncluding": "20110130",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110101:*:*:*:*:*:*:*",
              "matchCriteriaId": "FED67E3F-2F5F-4159-97C9-1A575134B42E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110102:*:*:*:*:*:*:*",
              "matchCriteriaId": "0459E83A-41BF-4994-B016-2F8755BC6D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110103:*:*:*:*:*:*:*",
              "matchCriteriaId": "E07ED0C1-7112-4E88-98A9-9E27F4571005",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110104:*:*:*:*:*:*:*",
              "matchCriteriaId": "11880F03-0C14-4266-8DE1-C99235073B23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110105:*:*:*:*:*:*:*",
              "matchCriteriaId": "22CC04CF-1D44-43CA-BFEE-307478E50F97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110106:*:*:*:*:*:*:*",
              "matchCriteriaId": "B277451A-5A3C-4874-BB33-DD4DF41BC4CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110107:*:*:*:*:*:*:*",
              "matchCriteriaId": "36FDC007-7028-4542-AB64-78842C9AE5FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110108:*:*:*:*:*:*:*",
              "matchCriteriaId": "D79FB11B-0BA2-4AF2-B5C9-9892BB1806DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110109:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC14E9C7-985D-451A-A3A7-A2955EDF5E39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110110:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA7478B0-32AA-4A9B-87FD-F281FCF11698",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110111:*:*:*:*:*:*:*",
              "matchCriteriaId": "C673A682-19BF-4693-ACF6-0421816360F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110112:*:*:*:*:*:*:*",
              "matchCriteriaId": "E821FCD3-5498-435B-9FB9-27204C7FAD79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110113:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C9986CD-5A19-4A9F-B9C5-071F10D75ACC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110114:*:*:*:*:*:*:*",
              "matchCriteriaId": "83B743F6-C590-41E2-9606-0AF2F1E6074B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110115:*:*:*:*:*:*:*",
              "matchCriteriaId": "1EC89726-C978-4B17-A29C-FB9A27077965",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110116:*:*:*:*:*:*:*",
              "matchCriteriaId": "5AF3CC54-5821-4B01-8410-E3153B8FB9C8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110117:*:*:*:*:*:*:*",
              "matchCriteriaId": "31AC80E2-094F-4BEC-B42C-7612FC1669A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110118:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8BCFB35-65DA-4355-8671-B89D63F33E15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110119:*:*:*:*:*:*:*",
              "matchCriteriaId": "DAAFD5D0-F4B7-46B3-9C53-119C08DE10E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110120:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3F8B84E-A479-40E8-849F-C2A1A0EB2F8B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110121:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B63D03E-5F8A-401F-B7BE-371D45C44AB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110122:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BDA4C98-2B93-4BB2-BD15-A10207C45B8D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110123:*:*:*:*:*:*:*",
              "matchCriteriaId": "CFD273E0-FE78-4549-A33F-30784ABDD59B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110124:*:*:*:*:*:*:*",
              "matchCriteriaId": "09C03F49-9E03-4F51-BB57-375E95EA1932",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110125:*:*:*:*:*:*:*",
              "matchCriteriaId": "822E0ACC-020A-4095-940E-927E32069921",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110126:*:*:*:*:*:*:*",
              "matchCriteriaId": "20BD2C29-0348-4A9E-AD3F-50A89E302DBC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110127:*:*:*:*:*:*:*",
              "matchCriteriaId": "65352BA8-8AF0-45F7-9908-D8A9B3E4EC1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110128:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BFE7D65-C4F8-4B93-879C-0AD4681DD04B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mj2:majordomo_2:20110129:*:*:*:*:*:*:*",
              "matchCriteriaId": "4635540B-E16C-4C9C-9624-BF4DF5F9F566",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de directorio en la funci\u00f3n _list_file_get en lib/Majordomo.pm en Majordomo v2 anterior a v20110131 permite a atacantes remotos leer ficheros arbitrarios mediante secuencias .. (punto punto) en el comando help, como se ha demostrado usando (1) un correo electr\u00f3nico manipulado y  (2) cgi-bin/mj_wwwusr en la interfaz web."
    }
  ],
  "id": "CVE-2011-0049",
  "lastModified": "2026-06-16T23:26:41.687",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2011-02-04T01:00:07.400",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/70762"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43125"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/8061"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.exploit-db.com/exploits/16103"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/363726"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/516150/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/46127"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1025024"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2011/0288"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://bug628064.bugzilla.mozilla.org/attachment.cgi?id=506481"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=628064"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65113"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "url": "https://sitewat.ch/en/Advisory/View/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/70762"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43125"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/8061"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.exploit-db.com/exploits/16103"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/363726"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/516150/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/46127"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1025024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2011/0288"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://bug628064.bugzilla.mozilla.org/attachment.cgi?id=506481"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=628064"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65113"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "url": "https://sitewat.ch/en/Advisory/View/1"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.