CVE-2019-6800

Description

In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scripts which are subsequently executed with root permissions. An attacker with a privileged network position is trivially able to inject arbitrary commands.

Weakness classification

• CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Primary references

• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory