CVE-2011-0049 : Directory traversal vulnerability in the _list_file

Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.

Published 2011-02-04 01:00:07

Updated 2018-10-10 20:09:24

Source MITRE

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2011-0049

MJ2 » Majordomo 2
Versions up to, including, (<=) 20110130
cpe:2.3:a:mj2:majordomo_2:*:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110124
cpe:2.3:a:mj2:majordomo_2:20110124:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110123
cpe:2.3:a:mj2:majordomo_2:20110123:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110115
cpe:2.3:a:mj2:majordomo_2:20110115:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110114
cpe:2.3:a:mj2:majordomo_2:20110114:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110107
cpe:2.3:a:mj2:majordomo_2:20110107:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110106
cpe:2.3:a:mj2:majordomo_2:20110106:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110129
cpe:2.3:a:mj2:majordomo_2:20110129:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110122
cpe:2.3:a:mj2:majordomo_2:20110122:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110121
cpe:2.3:a:mj2:majordomo_2:20110121:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110120
cpe:2.3:a:mj2:majordomo_2:20110120:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110113
cpe:2.3:a:mj2:majordomo_2:20110113:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110112
cpe:2.3:a:mj2:majordomo_2:20110112:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110105
cpe:2.3:a:mj2:majordomo_2:20110105:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110104
cpe:2.3:a:mj2:majordomo_2:20110104:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110126
cpe:2.3:a:mj2:majordomo_2:20110126:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110125
cpe:2.3:a:mj2:majordomo_2:20110125:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110117
cpe:2.3:a:mj2:majordomo_2:20110117:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110116
cpe:2.3:a:mj2:majordomo_2:20110116:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110109
cpe:2.3:a:mj2:majordomo_2:20110109:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110108
cpe:2.3:a:mj2:majordomo_2:20110108:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110101
cpe:2.3:a:mj2:majordomo_2:20110101:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110128
cpe:2.3:a:mj2:majordomo_2:20110128:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110127
cpe:2.3:a:mj2:majordomo_2:20110127:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110119
cpe:2.3:a:mj2:majordomo_2:20110119:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110118
cpe:2.3:a:mj2:majordomo_2:20110118:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110111
cpe:2.3:a:mj2:majordomo_2:20110111:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110110
cpe:2.3:a:mj2:majordomo_2:20110110:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110103
cpe:2.3:a:mj2:majordomo_2:20110103:*:*:*:*:*:*:*
Matching versions
MJ2 » Majordomo 2 » Version: 20110102
cpe:2.3:a:mj2:majordomo_2:20110102:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2011-0049

EPSS FAQ

88.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2011-0049

Majordomo2 _list_file_get() Directory Traversal

Disclosure Date: 2011-03-08

First seen: 2020-04-26

auxiliary/scanner/http/majordomo2_directory_traversal

This module exploits a directory traversal vulnerability present in the _list_file_get() function of Majordomo2 (help function). By default, this module will attempt to download the Majordomo config.pl file. Authors: - Nikolas Sotiriu

More information

CVSS scores for CVE-2011-0049

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2011-0049

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-0049

https://bug628064.bugzilla.mozilla.org/attachment.cgi?id=506481

628064 - (CVE-2011-0049) Directory traversal in majordomo2's 'help' command
Patch
http://www.securitytracker.com/id?1025024

Majordomo 2 Directory Traversal Flaw Discloses Arbitrary Files to Remote Users - SecurityTracker
http://www.vupen.com/english/advisories/2011/0288

Webmail | OVH- OVH
http://www.kb.cert.org/vuls/id/363726

VU#363726 - Majordomo 2 _list_file_get() directory traversal vulnerability
US Government Resource
http://securityreason.com/securityalert/8061

Majordomo2 - Directory Traversal (SMTP/HTTP) - CXSecurity.com
http://www.exploit-db.com/exploits/16103

Majordomo2 - 'SMTP/HTTP' Directory Traversal - Multiple remote Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/65113

Majordomo _list_file_get() directory traversal CVE-2011-0049 Vulnerability Report
https://sitewat.ch/en/Advisory/View/1

Exploit
http://www.securityfocus.com/archive/1/516150/100/0/threaded

SecurityFocus
http://www.securityfocus.com/bid/46127

Majordomo 2 'help' Command Directory Traversal Vulnerability
Exploit
https://bugzilla.mozilla.org/show_bug.cgi?id=628064

628064 - (CVE-2011-0049) Directory traversal in majordomo2's 'help' command
Exploit;Patch

Jump to