JVNDB-2025-000013

[Japanese]
JVNDB-2025-000013
acmailer CGI and acmailer DB vulnerable to OS command injection
Overview
acmailer CGI and acmailer DB provided by Extra Innovation Inc. contain an OS command injection vulnerability (CWE-78). Extra Innovation Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Extra Innovation Inc. coordinated under the Information Security Early Warning Partnership. JPCERT/CC Addendum The version fixing this vulnerability has been released on 2021. This JVN is published responding to the developer's notification to JPCERT/CC on 2025 about the vulnerability and the product update information.
CVSS Severity (What is CVSS?)
CVSS V3 Severity: Base Metrics 9.8 (Critical) [IPA Score] Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality Impact: High Integrity Impact: High Availability Impact: High
Affected Products

Extra Innovation Inc. acmailer CGI ver.4.0.3 and earlier acmailer DB ver.1.1.5 and earlier

Impact
An arbitrary OS command may be executed by an attacker.
Solution
[Update the software] Update the software to the latest version according to the information provided by the developer.
Vendor Information
Extra Innovation Inc. Extra Innovation Inc. : Regarding the vulnerabilities of acmailer and acmailer DB (3) (in Japanese) Extra Innovation Inc. : Released: acmailer CGI ver.4.0.4 and acmailer DB ver.1.1.6 (in Japanese) Extra Innovation Inc. : Download for acmailer CGI (in Japanese) Extra Innovation Inc. : Download for acmailer DB (in Japanese)
CWE (What is CWE?)
OS Command Injection(CWE-78) [IPA Evaluation]
CVE (What is CVE?)
CVE-2021-46686
References
JVN : JVN#96957439
Revision History
[2025/02/14] Web page was published


Date Public	2025/02/14
Date First Published	2025/02/14
Date Last Updated	2025/02/14

acmailer CGI and acmailer DB vulnerable to OS command injection