Lucene search

Japan Vulnerability NotesJVN:50899877

HistoryJan 15, 2016 - 12:00 a.m.

JVN#50899877: acmailer vulnerable to OS command injection

2016-01-1500:00:00

Japan Vulnerability Notes

jvn.jp

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

0.003

Percentile

70.8%

JSON

acmailer provided by Seeds Co.,Ltd. contains an OS command injection vulnerability (CWE-78).

Impact

An authenticated attacker may execute an arbitrary OS command on the server.

Solution

Update the software
Update to the latest version according to the information provided by the developer.

Products Affected

acmailer versions prior to 3.8.21
acmailer versions prior to 3.9.15 Beta

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

0.003

Percentile

70.8%

JSON

Related for JVN:50899877