CVE-2018-14357

CRITICAL EPSS 91.1%

Published Jul 17, 20187y ago · Modified Jun 17, 20262w ago

9.8 CVSS 3.1

Critical

Published Jul 17, 2018 7y ago

Last Modified Jun 17, 2026 2w ago

Description

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.

CVSS Details

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

91.1% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-78 OS Command Injection Injection

Affected Products 20

Vendor	Product	Version	Range
mutt	mutt	*	<1.10.1
neomutt	neomutt	*	<20180716
canonical	ubuntu_linux	14.04	any
canonical	ubuntu_linux	16.04	any
canonical	ubuntu_linux	18.04	any
debian	debian_linux	8.0	any
debian	debian_linux	9.0	any
redhat	enterprise_linux_desktop	6.0	any
redhat	enterprise_linux_desktop	7.0	any
redhat	enterprise_linux_server	6.0	any
redhat	enterprise_linux_server	7.0	any
redhat	enterprise_linux_server_aus	7.6	any
redhat	enterprise_linux_server_aus	7.7	any
redhat	enterprise_linux_server_eus	7.5	any
redhat	enterprise_linux_server_eus	7.6	any
redhat	enterprise_linux_server_eus	7.7	any
redhat	enterprise_linux_server_tus	7.6	any
redhat	enterprise_linux_server_tus	7.7	any
redhat	enterprise_linux_workstation	6.0	any
redhat	enterprise_linux_workstation	7.0	any

References 10

mutt.org http://www.mutt.org/news.html

Release NotesVendor Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2018:2526

Third Party Advisory
github.com https://github.com/neomutt/neomutt/commit/e52393740334443ae0206cab2d7caef381646725

PatchThird Party Advisory
gitlab.com https://gitlab.com/muttmua/mutt/commit/185152818541f5cdc059cbff3f3e8b654fc27c1d

PatchThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2018/08/msg00001.html

Mailing ListThird Party Advisory
neomutt.org https://neomutt.org/2018/07/16/release

Release NotesVendor Advisory
security.gentoo.org https://security.gentoo.org/glsa/201810-07

Third Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/3719-1/

Third Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/3719-3/

Third Party Advisory
debian.org https://www.debian.org/security/2018/dsa-4277

Third Party Advisory

Remediation

github.com https://github.com/neomutt/neomutt/commit/e52393740334443ae0206cab2d7caef381646725

PatchThird Party Advisory
gitlab.com https://gitlab.com/muttmua/mutt/commit/185152818541f5cdc059cbff3f3e8b654fc27c1d

PatchThird Party Advisory