VULNERABILITY INTELLIGENCE
CVE-2010-1132
CVSS score9.3 HIGH
EPSS probability8.55%
CISA KEVNot currently listed
Published2010-03-27
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Description
The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.
Weakness classification
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Primary references
- cve@mitre.org — Exploit
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Vendor Advisory
- cve@mitre.org
- cve@mitre.org — Exploit
- cve@mitre.org — Exploit