CVE-2023-50917
Published: 15 December 2023
Summary
CVE-2023-50917 is a critical-severity Command Injection (CWE-77) vulnerability in Mjdm Majordomo. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
MajorDoMo, also known as Major Domestic Module, is affected by CVE-2023-50917 prior to commit 0662e5e. The flaw is a command injection vulnerability (CWE-77) that permits arbitrary command execution through shell metacharacters supplied to thumb.php. It carries a CVSS 3.1 score of 9.8 and is unrelated to the Majordomo mailing-list software.
Unauthenticated attackers with network access can exploit the issue without user interaction or credentials. Successful exploitation grants full control over the affected system, including the ability to read, modify, or delete data and execute code with the privileges of the web server process.
Public exploit code has been disclosed via Packet Storm and the Full Disclosure mailing list, while the project addressed the flaw in commits 0662e5ebfb133445ff6154b69c61019357092178 and 3ec3ffb863ea3c2661ab27d398776c551f4daaac. The associated EPSS score remains elevated near its recorded peak of 0.9275, indicating sustained exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55648
Vulnerability details
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.