The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier…
Priority MEDIUM 64CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the "extra" parameter to the help command, which causes the regular expression to produce .. (dot dot) sequences. NOTE: this vulnerability is due to an incomplete fix for CVE-2011-0049.
Why it matters now
EPSS 0.85451 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mj2:majordomo_2:*:*:*:*:*:*:*:* | up to 20110203 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110101:*:*:*:*:*:*:* | 20110101 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110102:*:*:*:*:*:*:* | 20110102 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110103:*:*:*:*:*:*:* | 20110103 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110104:*:*:*:*:*:*:* | 20110104 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110105:*:*:*:*:*:*:* | 20110105 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110106:*:*:*:*:*:*:* | 20110106 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110107:*:*:*:*:*:*:* | 20110107 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110108:*:*:*:*:*:*:* | 20110108 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110109:*:*:*:*:*:*:* | 20110109 | Vulnerable | Mj2 |
- cpe:2.3:a:mj2:majordomo_2:*:*:*:*:*:*:*:* Versions up to 20110203 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110101:*:*:*:*:*:*:* Versions 20110101 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110102:*:*:*:*:*:*:* Versions 20110102 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110103:*:*:*:*:*:*:* Versions 20110103 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110104:*:*:*:*:*:*:* Versions 20110104 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110105:*:*:*:*:*:*:* Versions 20110105 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110106:*:*:*:*:*:*:* Versions 20110106 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110107:*:*:*:*:*:*:* Versions 20110107 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110108:*:*:*:*:*:*:* Versions 20110108 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110109:*:*:*:*:*:*:* Versions 20110109 Vulnerable ·Mj2
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mj2:majordomo_2:20110110:*:*:*:*:*:*:* | 20110110 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110111:*:*:*:*:*:*:* | 20110111 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110112:*:*:*:*:*:*:* | 20110112 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110113:*:*:*:*:*:*:* | 20110113 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110114:*:*:*:*:*:*:* | 20110114 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110115:*:*:*:*:*:*:* | 20110115 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110116:*:*:*:*:*:*:* | 20110116 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110117:*:*:*:*:*:*:* | 20110117 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110118:*:*:*:*:*:*:* | 20110118 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110119:*:*:*:*:*:*:* | 20110119 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110120:*:*:*:*:*:*:* | 20110120 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110121:*:*:*:*:*:*:* | 20110121 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110122:*:*:*:*:*:*:* | 20110122 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110123:*:*:*:*:*:*:* | 20110123 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110124:*:*:*:*:*:*:* | 20110124 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110125:*:*:*:*:*:*:* | 20110125 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110126:*:*:*:*:*:*:* | 20110126 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110127:*:*:*:*:*:*:* | 20110127 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110128:*:*:*:*:*:*:* | 20110128 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110129:*:*:*:*:*:*:* | 20110129 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110130:*:*:*:*:*:*:* | 20110130 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110131:*:*:*:*:*:*:* | 20110131 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110201:*:*:*:*:*:*:* | 20110201 | Vulnerable | Mj2 |
| cpe:2.3:a:mj2:majordomo_2:20110202:*:*:*:*:*:*:* | 20110202 | Vulnerable | Mj2 |
- cpe:2.3:a:mj2:majordomo_2:20110110:*:*:*:*:*:*:* Versions 20110110 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110111:*:*:*:*:*:*:* Versions 20110111 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110112:*:*:*:*:*:*:* Versions 20110112 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110113:*:*:*:*:*:*:* Versions 20110113 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110114:*:*:*:*:*:*:* Versions 20110114 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110115:*:*:*:*:*:*:* Versions 20110115 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110116:*:*:*:*:*:*:* Versions 20110116 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110117:*:*:*:*:*:*:* Versions 20110117 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110118:*:*:*:*:*:*:* Versions 20110118 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110119:*:*:*:*:*:*:* Versions 20110119 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110120:*:*:*:*:*:*:* Versions 20110120 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110121:*:*:*:*:*:*:* Versions 20110121 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110122:*:*:*:*:*:*:* Versions 20110122 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110123:*:*:*:*:*:*:* Versions 20110123 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110124:*:*:*:*:*:*:* Versions 20110124 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110125:*:*:*:*:*:*:* Versions 20110125 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110126:*:*:*:*:*:*:* Versions 20110126 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110127:*:*:*:*:*:*:* Versions 20110127 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110128:*:*:*:*:*:*:* Versions 20110128 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110129:*:*:*:*:*:*:* Versions 20110129 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110130:*:*:*:*:*:*:* Versions 20110130 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110131:*:*:*:*:*:*:* Versions 20110131 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110201:*:*:*:*:*:*:* Versions 20110201 Vulnerable ·Mj2
- cpe:2.3:a:mj2:majordomo_2:20110202:*:*:*:*:*:*:* Versions 20110202 Vulnerable ·Mj2
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2011-0063
- 2026-10-03 Alias added: GHSA-rjjv-8xhv-gg57
References
More Mj2 Majordomo 2 vulnerabilities
- TI-2011-00047 Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2011-0063 · CVE Program
- CVE-2011-0063 · NVD
- FIRST EPSS
- GHSA-rjjv-8xhv-gg57 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences