CVE-2001-1246

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2001-1246
PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://online.securityfocus.com/archive/1/194425 Broken Link Third Party Advisory VDB Entry
http://www.iss.net/security_center/static/6787.php Broken Link Patch Vendor Advisory
http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz Broken Link
http://www.redhat.com/support/errata/RHSA-2002-102.html Broken Link
http://www.redhat.com/support/errata/RHSA-2002-129.html Broken Link
http://www.redhat.com/support/errata/RHSA-2003-159.html Broken Link
http://www.securityfocus.com/bid/2954 Broken Link Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
History

14 Feb 2024, 15:17

Type Values Removed Values Added
References () http://online.securityfocus.com/archive/1/194425 - () http://online.securityfocus.com/archive/1/194425 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.iss.net/security_center/static/6787.php - Patch, Vendor Advisory () http://www.iss.net/security_center/static/6787.php - Broken Link, Patch, Vendor Advisory
References () http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz - () http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz - Broken Link
References () http://www.redhat.com/support/errata/RHSA-2002-102.html - () http://www.redhat.com/support/errata/RHSA-2002-102.html - Broken Link
References () http://www.redhat.com/support/errata/RHSA-2002-129.html - () http://www.redhat.com/support/errata/RHSA-2002-129.html - Broken Link
References () http://www.redhat.com/support/errata/RHSA-2003-159.html - () http://www.redhat.com/support/errata/RHSA-2003-159.html - Broken Link
References () http://www.securityfocus.com/bid/2954 - () http://www.securityfocus.com/bid/2954 - Broken Link, Third Party Advisory, VDB Entry
CWE NVD-CWE-Other CWE-88
CPE cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:* cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Information

Published : 2001-06-30 04:00

Updated : 2024-02-14 15:17

NVD link : CVE-2001-1246

Mitre link : CVE-2001-1246

CVE.ORG link : CVE-2001-1246

JSON object : View

Products Affected

php

  • php
CWE
CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')