CVEvulnerability

CVE-2004-2284

10.0 HIGH Published 2004-12-31 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2004-12-31
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

The read_list_from_file function in vacation.pl for OpenWebmail before 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename argument.

Affected configurations

• open webmail open webmail 1.7 • open webmail open webmail 1.8 • open webmail open webmail 1.71 • open webmail open webmail 1.81 • open webmail open webmail 1.90 • open webmail open webmail 2.20 • open webmail open webmail 2.21 • open webmail open webmail 2.30 • open webmail open webmail 2.31 • open webmail open webmail 2.32

References

http://openwebmail.org/openwebmail/download/cert/advisories/SA-04:04.txt Patch, Vendor Advisory
http://secunia.com/advisories/12017 Patch, Vendor Advisory
http://securitytracker.com/id?1010605 Patch
http://www.osvdb.org/7474 Patch
http://www.securityfocus.com/bid/10637 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/16549 exchange.xforce.ibmcloud.com
http://openwebmail.org/openwebmail/download/cert/advisories/SA-04:04.txt Patch, Vendor Advisory
http://secunia.com/advisories/12017 Patch, Vendor Advisory
http://securitytracker.com/id?1010605 Patch
http://www.osvdb.org/7474 Patch
http://www.securityfocus.com/bid/10637 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/16549 exchange.xforce.ibmcloud.com