Vulnerability Details : CVE-2009-1381

Potential exploit
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
Published 2009-05-22 20:30:01
Updated 2025-04-09 00:30:58
Source Red Hat, Inc.
View at NVD,   CVE.org

Products affected by CVE-2009-1381

Exploit prediction scoring system (EPSS) score for CVE-2009-1381

EPSS FAQ
0.59%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 67 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-1381

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
6.8
 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P
8.6
6.4
 NIST

Vendor statements for CVE-2009-1381

  • Red Hat 2009-05-26
    Not vulnerable. This issue did not affect the versions of squirrelmail as shipped with Red Hat Enterprise Linux 3, 4, or 5. Updates for squirrelmail released via RHSA-2009:1066 (https://rhn.redhat.com/errata/RHSA-2009-1066.html) fixed original flaw CVE-2009-1579 without introducing CVE-2009-1381.

References for CVE-2009-1381

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close