CVE-2011-0049 is a directory traversal vulnerability in Majordomo 2 (versions prior to 20110131), specifically within the _list_file_get function in lib/Majordomo.pm. This flaw allows unauthenticated remote attackers to read arbitrary files on the server by injecting ".." sequences into the help command via crafted emails or the web interface. The vulnerability has a CVSS score of 5.0, indicating a medium severity with low attack complexity and no authentication required, leading to potential information disclosure. While not listed in CISA's KEV catalog, exploit modules are publicly available in Metasploit and Nuclei, and it has a high EPSS score, suggesting a significant likelihood of exploitation. There is no evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 20110130CPE matchmatch criteria | cpe:2.3:a:mj2:majordomo_2:*:*:*:*:*:*:*:* | ||
20110101CPE matchmatch criteria | cpe:2.3:a:mj2:majordomo_2:20110101:*:*:*:*:*:*:* | ||
20110102CPE matchmatch criteria | cpe:2.3:a:mj2:majordomo_2:20110102:*:*:*:*:*:*:* | ||
20110103CPE matchmatch criteria | cpe:2.3:a:mj2:majordomo_2:20110103:*:*:*:*:*:*:* | ||
20110104CPE matchmatch criteria | cpe:2.3:a:mj2:majordomo_2:20110104:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.