CVE-2006-5449 Command injection in n/a
Authenticated users can execute arbitrary commands via shell metacharacters in filter rules within the Horde mail module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-5449?
CVE-2006-5449 is a medium-severity command injection vulnerability in n/a, published on 23 Oct 2006. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
procmail in Ingo H3 before 1.1.2 Horde module allows remote authenticated users to execute arbitrary commands via shell metacharacters in the mailbox destination of a filter rule.
Which versions are affected by CVE-2006-5449?
It affects 1 product.
Products include Horde Ingo H3.
How do I fix CVE-2006-5449?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2006-5449 being exploited?
There is no known exploitation of CVE-2006-5449 in the wild and no public exploit code.
Sources
Also known as DSA-1204-1, GHSA-f237-47jc-vx5c.