CVE-2000-0411: Medium severity matt wright formmail vulnerability
Matt Wright's FormMail CGI script allows remote attackers to obtain environmental variables via the envreport parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Matt Wright FormMailfrom your environment.Uninstall or remove the FormMail CGI script from the webserver if it is not required.
- Configuration
Disable handling of the env_report parameter in the FormMail CGI script (for example, remove or comment out the code that reads and outputs environment variables for env_report).
Matt Wright FormMail env_report = disabled - Compensating control
Restrict access to the FormMail script (for example via web server access controls, firewall rules, or a WAF) so only trusted IPs or authenticated users can reach it until a fix or replacement is implemented.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0411?
The severity of CVE-2000-0411 is considered high due to the potential for remote attackers to exploit sensitive environmental variables.
How do I fix CVE-2000-0411?
To fix CVE-2000-0411, upgrade to a more secure version of Matt Wright's FormMail CGI script that does not expose environmental variables.
Who is affected by CVE-2000-0411?
CVE-2000-0411 affects users of Matt Wright's FormMail version 1.6.
What type of attack can be executed using CVE-2000-0411?
An attacker can execute information disclosure attacks by manipulating the env_report parameter to gain access to sensitive environmental variables.
Is there a workaround for CVE-2000-0411 if I cannot upgrade?
A potential workaround for CVE-2000-0411 is to disable or remove the env_report parameter from the FormMail script until an upgrade is possible.