CVE-2019-10149

🗓️ 05 Jun 2019 00:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 1791 Views🌐 WEB

CVE-2019-10149 Exim versions 4.87 to 4.91 (inclusive) allow remote command execution

Reporter	Title	Published	Views	Family All 110
0day.today	Exim 4.87 < 4.91 - (Local / Remote) Command Execution Exploit	7 Jun 201900:00	–	zdt
0day.today	Exim 4.91 Local Privilege Escalation Exploit	17 Jun 201900:00	–	zdt
0day.today	Exim 4.87 / 4.91 - Local Privilege Escalation Exploit	23 Aug 201900:00	–	zdt
GithubExploit	Exploit for OS Command Injection in Exim	21 Jan 202602:08	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Exim	21 Oct 201908:13	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Exim	12 Jun 201903:47	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Exim	3 Jun 202002:27	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Exim	25 Jul 201900:46	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Exim	13 Jun 201923:21	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Exim	27 Jun 201901:34	–	githubexploit

NVD

Vulners

Node

exim eximRange4.87–4.91

Node

canonical ubuntu_linuxMatch18.04lts

canonical ubuntu_linuxMatch18.10

debian debian_linuxMatch9.0

[
  {
    "vendor": "exim",
    "product": "exim",
    "versions": [
      {
        "version": "4.92",
        "status": "affected"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2021/05/04/7
openwall	www.openwall.com/lists/oss-security/2019/07/26/4
usn	www.usn.ubuntu.com/4010-1/
packetstormsecurity	www.packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html
packetstormsecurity	www.packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html
seclists	www.seclists.org/bugtraq/2019/Jun/5
openwall	www.openwall.com/lists/oss-security/2019/06/05/4
openwall	www.openwall.com/lists/oss-security/2019/06/05/3
openwall	www.openwall.com/lists/oss-security/2019/06/06/1
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

Parameter	Position	Path	Description	CWE
RCPT TO	nested	/src/deliver.c	Improper validation of recipient address enabling remote command execution via RCPT TO during SMTP processing (Exim deliver_message).	CWE-78

06 Nov 2025 14:49Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

CVSS 210

CVSS 39

EPSS0.93918

SSVC