CVE-2011-0063

Published: Mar 15, 2011Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the "extra" parameter to the help command, which causes the regular expression to produce .. (dot dot) sequences. NOTE: this vulnerability is due to an incomplete fix for CVE-2011-0049.

Affected (34)

Products: Mj2: Majordomo 2

Mj2

1 product

Majordomo 2

Configuration A

34 vulnerable

Vulnerable Software	Affected Versions
Mj2 Majordomo 2	Up to 20110203
Mj2 Majordomo 2	Version 20110101
Mj2 Majordomo 2	Version 20110102
Mj2 Majordomo 2	Version 20110103
Mj2 Majordomo 2	Version 20110104
Mj2 Majordomo 2	Version 20110105
Mj2 Majordomo 2	Version 20110106
Mj2 Majordomo 2	Version 20110107
Mj2 Majordomo 2	Version 20110108
Mj2 Majordomo 2	Version 20110109
Mj2 Majordomo 2	Version 20110110
Mj2 Majordomo 2	Version 20110111
Mj2 Majordomo 2	Version 20110112
Mj2 Majordomo 2	Version 20110113
Mj2 Majordomo 2	Version 20110114
Mj2 Majordomo 2	Version 20110115
Mj2 Majordomo 2	Version 20110116
Mj2 Majordomo 2	Version 20110117
Mj2 Majordomo 2	Version 20110118
Mj2 Majordomo 2	Version 20110119
Mj2 Majordomo 2	Version 20110120
Mj2 Majordomo 2	Version 20110121
Mj2 Majordomo 2	Version 20110122
Mj2 Majordomo 2	Version 20110123
Mj2 Majordomo 2	Version 20110124
Mj2 Majordomo 2	Version 20110125
Mj2 Majordomo 2	Version 20110126
Mj2 Majordomo 2	Version 20110127
Mj2 Majordomo 2	Version 20110128
Mj2 Majordomo 2	Version 20110129
Mj2 Majordomo 2	Version 20110130
Mj2 Majordomo 2	Version 20110131
Mj2 Majordomo 2	Version 20110201
Mj2 Majordomo 2	Version 20110202