CVEvulnerability

CVE-2011-0063

5.0 MEDIUM Published 2011-03-15 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2011-03-15
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-22

Description

The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the "extra" parameter to the help command, which causes the regular expression to produce .. (dot dot) sequences. NOTE: this vulnerability is due to an incomplete fix for CVE-2011-0049.

Affected configurations

• mj2 majordomo 2 (<= 20110203) • mj2 majordomo 2 20110101 • mj2 majordomo 2 20110102 • mj2 majordomo 2 20110103 • mj2 majordomo 2 20110104 • mj2 majordomo 2 20110105 • mj2 majordomo 2 20110106 • mj2 majordomo 2 20110107 • mj2 majordomo 2 20110108 • mj2 majordomo 2 20110109 • mj2 majordomo 2 20110110 • mj2 majordomo 2 20110111 • mj2 majordomo 2 20110112 • mj2 majordomo 2 20110113 • mj2 majordomo 2 20110114 • mj2 majordomo 2 20110115 • mj2 majordomo 2 20110116 • mj2 majordomo 2 20110117 • mj2 majordomo 2 20110118 • mj2 majordomo 2 20110119 • mj2 majordomo 2 20110120 • mj2 majordomo 2 20110121 • mj2 majordomo 2 20110122 • mj2 majordomo 2 20110123 • mj2 majordomo 2 20110124 • mj2 majordomo 2 20110125 • mj2 majordomo 2 20110126 • mj2 majordomo 2 20110127 • mj2 majordomo 2 20110128 • mj2 majordomo 2 20110129 • mj2 majordomo 2 20110130 • mj2 majordomo 2 20110131 • mj2 majordomo 2 20110201 • mj2 majordomo 2 20110202

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References