CVEvulnerability

CVE-2010-4345

7.8 HIGH Known exploited Published 2010-12-14 Modified 2026-06-16 Official page ↗

CISA Known Exploited Vulnerability

Exim Privilege Escalation Vulnerability — Exim Exim

Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.

Added to KEV
2022-03-25
Remediation due
2022-04-15
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2010-4345
Status
Analyzed
Published
2010-12-14
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-77

Description

Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.

Affected configurations

• exim exim (<= 4.72) • opensuse opensuse 11.1 • opensuse opensuse 11.2 • opensuse opensuse 11.3 • debian debian linux 5.0 • canonical ubuntu linux 6.06 • canonical ubuntu linux 8.04 • canonical ubuntu linux 9.10 • canonical ubuntu linux 10.04 • canonical ubuntu linux 10.10

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References