search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Majordomo 2 _list_file_get() directory traversal vulnerability

Vulnerability Note VU#363726

Original Release Date: 2011-02-04 | Last Revised: 2011-03-28


Majordomo 2 contains a directory traversal vulnerability in the _list_file_get()function, which may allow a remote, unauthenticated attacker to obtain sensitive information.


Majordomo 2 contains a directory traversal vulnerability in the _list_file_get()function (lib/ caused by an input validation error when handling files. An attacker can exploit this vulnerability via directory traversal specifiers sent in a specially crafted request to any of the application's interfaces (e.g. email or web).

Additional information regarding this vulnerability can be found in this Sitewatch Advisory.


A remote unauthenticated attacker could obtain sensitive information.


Majordomo 2 recommends users update to snapshot 20110204 or later.

Vendor Information

The vulnerability is reported in snapshots prior to 20110204.

Affected   Unknown   Unaffected

Majordomo 2

Updated:  February 04, 2011



Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A



This vulnerability was reported by Michael Brooks.

This document was written by Michael Orlando.

Other Information

CVE IDs: CVE-2011-0049
Severity Metric: 25.20
Date Public: 2011-02-04
Date First Published: 2011-02-04
Date Last Updated: 2011-03-28 12:27 UTC
Document Revision: 21

Sponsored by CISA.