CVE-2007-3636 describes multiple unspecified remote command execution vulnerabilities within the G/PGP (GPG) Plugin 2.1 for Squirrelmail. This flaw allows unauthenticated remote attackers to execute arbitrary commands, posing a significant risk to affected Squirrelmail installations utilizing the plugin. With a CVSS score of 7.5, it is considered highly severe due to its network-based attack vector and potential for complete compromise (confidentiality, integrity, availability). While not listed on CISA's KEV catalog, public exploit code exists (EDB-30283), indicating a clear path for exploitation, despite a lack of observed active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.0CPE matchmatch criteria | cpe:2.3:a:squirrelmail:gpg_plugin:2.0:*:*:*:*:*:*:* | ||
1.4.10aCPE matchmatch criteria | cpe:2.3:a:squirrelmail:squirrelmail:1.4.10a:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.