by Kastro
Paper/Archive/CVE-2021-46686

CVE-2021-46686

Extra Innovation Inc. acmailer CGI — Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and ear…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.9.729 × 2014.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB ver.1.1.5 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker.

Affected

ProductAffectedFixed inSource
acmailer CGIver.4.0.3 and earlier–CNA
acmailer DBver.1.1.5 and earlier–CNA

Scores by source

jpcert (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refacmailer.jp/info/de.cgi?id=103refacmailer.jp/info/de.cgi?id=102refjvn.jp/en/jp/JVN96957439