Vulnerability record · CVE-2011-0049 · published 4 February 2011
CVE-2011-0049: Majordomo 2 help command path traversal allows arbitrary file read
Mj2 · Majordomo 2
Majordomo 2 before 20110131 contains a directory traversal flaw in the _list_file_get function in lib/Majordomo.pm. The help command fails to sanitize '..' sequences, letting a remote attacker read files outside the intended directory. Because the flaw is reachable both by email and through the cgi-bin/mj_wwwusr web interface, it exposes mailing list server configuration and credential files.
Description
Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr in the web interface.
AV:N/AC:L/Au:N/C:P/I:N/A:N
Automated analysis
high priorityUnauthenticated remote file read with public exploit code and a very high EPSS score, though not observed in KEV and limited to confidentiality impact.
What it is
Majordomo 2 before 20110131 contains a directory traversal flaw in the _list_file_get function in lib/Majordomo.pm. The help command fails to sanitize '..' sequences, letting a remote attacker read files outside the intended directory. Because the flaw is reachable both by email and through the cgi-bin/mj_wwwusr web interface, it exposes mailing list server configuration and credential files.
Impact
An attacker gains read access to arbitrary files on the Majordomo host, which can include configuration files, list archives and stored credentials. There is no write or code execution impact per the CVSS vector, so the loss is confidentiality only.
Attack surface
Reachable remotely over the network with no authentication and no user interaction, per the AV:N/AC:L/Au:N vector. Two paths exist: a crafted email to the help command and the cgi-bin/mj_wwwusr web interface.
Exploitation
Public exploit code exists (Exploit-DB 16103 and Exploit and Patch tags on the Mozilla bug and sitewat.ch advisory), and EPSS is very high at 0.954 (99.9th percentile), though the CVE is not listed in CISA KEV.
What to do
- Upgrade Majordomo 2 to 20110131 or later, which contains the fix.
- If upgrade is not possible, restrict or disable the help command and the cgi-bin/mj_wwwusr interface.
- Run the Majordomo service and web interface under a low-privilege account with access limited to required list directories.
- Place the web interface behind authentication and network access controls until patched.
Detection
- Search Majordomo logs for help command requests containing '..' sequences or absolute paths.
- Monitor web server logs for cgi-bin/mj_wwwusr requests with traversal patterns in parameters.
- Alert on outbound reads of sensitive files such as /etc/passwd or Majordomo config files by the Majordomo process.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2011-0049 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2011-0049), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
