E-Mail Security Virtual Appliance learn-msg.cgi Command Injection
Vulnerability Description
The E-Mail Security Virtual Appliance (ESVA) (tested on version ESVA_2057) contains an unauthenticated command injection vulnerability in the learn-msg.cgi script. The CGI handler fails to sanitize user-supplied input passed via the id parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and results in full command execution on the underlying system.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-10046
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- iJoo
References
- https://sourceforge.net/projects/esva-project/
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/esva_exec.rb
- https://www.exploit-db.com/exploits/20551
- https://www.exploit-db.com/exploits/20712
- https://www.vulncheck.com/advisories/email-security-virtual-appliance-command-injection
Affected Vendor
ESVA-Project
View all reports →