Cyber Resilience

CVE-2023-50917

CriticalPublic PoCRCE

Published: 15 December 2023

Published
15 December 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9264 99.8th percentile
Risk Priority 75 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-50917 is a critical-severity Command Injection (CWE-77) vulnerability in Mjdm Majordomo. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

MajorDoMo, also known as Major Domestic Module, is affected by CVE-2023-50917 prior to commit 0662e5e. The flaw is a command injection vulnerability (CWE-77) that permits arbitrary command execution through shell metacharacters supplied to thumb.php. It carries a CVSS 3.1 score of 9.8 and is unrelated to the Majordomo mailing-list software.

Unauthenticated attackers with network access can exploit the issue without user interaction or credentials. Successful exploitation grants full control over the affected system, including the ability to read, modify, or delete data and execute code with the privileges of the web server process.

Public exploit code has been disclosed via Packet Storm and the Full Disclosure mailing list, while the project addressed the flaw in commits 0662e5ebfb133445ff6154b69c61019357092178 and 3ec3ffb863ea3c2661ab27d398776c551f4daaac. The associated EPSS score remains elevated near its recorded peak of 0.9275, indicating sustained exploitation interest after public disclosure.

EU & UK References

Vulnerability details

MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

mjdm
majordomo
≤ 2023-11-15

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References