Vulnerability Name:

CVE-2004-2284 (CCN-16549)

Assigned:2004-06-29
Published:2004-06-29
Updated:2017-07-11
Summary:The read_list_from_file function in vacation.pl for OpenWebmail before 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename argument.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2004-2284

Source: CCN
Type: Open WebMail Web site
Open WebMail

Source: CONFIRM
Type: Patch, Vendor Advisory
http://openwebmail.org/openwebmail/download/cert/advisories/SA-04:04.txt

Source: CCN
Type: SA12017
Open WebMail "vacation.pl" Arbitrary Program Execution Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
12017

Source: CCN
Type: SECTRACK ID: 1010605
Open WebMail Input Validation Flaw in `vacation.pl` Lets Remote Users Execute Arbitrary Programs

Source: SECTRACK
Type: Patch
1010605

Source: OSVDB
Type: Patch
7474

Source: CCN
Type: OSVDB ID: 7474
Open WebMail vacation.pl Arbitrary Command Execution

Source: BID
Type: Patch
10637

Source: CCN
Type: BID-10637
Open WebMail Vacation.PL Remote Command Execution Variant Vulnerability

Source: XF
Type: UNKNOWN
open-webmail-vacation-program-execution(16549)

Source: XF
Type: UNKNOWN
open-webmail-vacation-program-execution(16549)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:open_webmail:open_webmail:1.7:*:*:*:*:*:*:*
  • OR cpe:/a:open_webmail:open_webmail:1.8:*:*:*:*:*:*:*
  • OR cpe:/a:open_webmail:open_webmail:1.71:*:*:*:*:*:*:*
  • OR cpe:/a:open_webmail:open_webmail:1.81:*:*:*:*:*:*:*
  • OR cpe:/a:open_webmail:open_webmail:1.90:*:*:*:*:*:*:*
  • OR cpe:/a:open_webmail:open_webmail:2.20:*:*:*:*:*:*:*
  • OR cpe:/a:open_webmail:open_webmail:2.21:*:*:*:*:*:*:*
  • OR cpe:/a:open_webmail:open_webmail:2.30:*:*:*:*:*:*:*
  • OR cpe:/a:open_webmail:open_webmail:2.31:*:*:*:*:*:*:*
  • OR cpe:/a:open_webmail:open_webmail:2.32:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    open_webmail open webmail 1.7
    open_webmail open webmail 1.8
    open_webmail open webmail 1.71
    open_webmail open webmail 1.81
    open_webmail open webmail 1.90
    open_webmail open webmail 2.20
    open_webmail open webmail 2.21
    open_webmail open webmail 2.30
    open_webmail open webmail 2.31
    open_webmail open webmail 2.32