Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Directory traversal vulnerability in Endymion MailMan before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) and a null character in the ALTERNATE_TEMPLATES parameter for various mmstdo*.cgi programs.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Endymion MailMan 预备模板变量使文件泄露漏洞
Vulnerability Description
Endymion MailMan是一款基于WEB的邮件应用程序，运行在多种Unix和Linux系统平台下，也可运行于Windows平台下，由PERL脚本语言实现。 Endymion MailMan实现上存在输入验证漏洞，可导致任意文件内容被泄露问题。 由于Endymion MailMan对用户提交给ALTERNATE_TEMPLATES CGI 变量的输入没有过滤，导致程序存在目录遍历问题，远程攻击者可以通过提交包含连续(../)并在请求文件名后追加NULL字符(%00)的HTTP请求，可导致突破wwwr
CVSS Information
N/A
Vulnerability Type
N/A