Security Advisory

CVE-2012-10046

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-08-08 18:11:08

Last updated 2026-04-07 14:02:41

Assigner VulnCheck

CVSS score 9.3

State PUBLISHED

Description

The E-Mail Security Virtual Appliance (ESVA) (tested on version ESVA_2057) contains an unauthenticated command injection vulnerability in the learn-msg.cgi script. The CGI handler fails to sanitize user-supplied input passed via the id parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and results in full command execution on the underlying system.

← Browse all CVEs View on cve.org ↗