CVE-2018-16744

An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow for command injection if untrusted input can reach it, because popen is used.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@mitre.org

Published

2018-09-13

Last modified

2024-08-05

Weaknesses

CWE-78

Affected products

• Mgetty (Mgetty Project)

References

• https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty