CVE-2018-14354
CVE-2018-14354 is a critical vulnerability affecting Mutt before version 1.10.1 and NeoMutt before 2018-07-16, allowing remote IMAP servers to execute arbitrary commands. This is due to improper handling of backquote characters within the mailboxes command during manual subscription or unsubscription. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk as it can be exploited remotely with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
Impacted Technologies
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.10.1CPE matchmatch criteria | cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:* | ||
< 20180716CPE matchmatch criteria | cpe:2.3:a:neomutt:neomutt:*:*:*:*:*:*:*:* | ||
12.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* | ||
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* |
CVSS Data
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit Intelligence
Social Chatter
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
Media Mentions
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.