CVE-2013-4495
The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue...
The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.
Exploit likelihood
What each source reports
NVD Score used
The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.
- Record
CVE-2013-4495- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.
- Record
CVE-2013-4495- Updated
- 2026-11-02
EUVDEUVD-2013-4357 No score
The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.
- Record
EUVD-2013-4357- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6xr2-x79f-r46g No score
The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue...
The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.
- Record
GHSA-6xr2-x79f-r46g- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVMGASA-2013-0327 No score
Updated torque packages fix CVE-2013-4495
Updated torque packages fix security vulnerability:
A user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these commands to be executed as root on the pbs_server (CVE-2013-4495).
- Record
MGASA-2013-0327- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4495 No score
The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.
- Record
UBUNTU-CVE-2013-4495- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
torqueDebian:6.0 |
before 2.4.8+dfsg-9squeeze3, plus listed versions 2.4.8+dfsg-92.4.8+dfsg-9squeeze12.4.8+dfsg-9squeeze2 |
2.4.8+dfsg-9squeeze3 |
torqueDebian:7 |
before 2.4.16+dfsg-1+deb7u2, plus listed versions 2.4.16+dfsg-12.4.16+dfsg-1+deb7u1 |
2.4.16+dfsg-1+deb7u2 |
torqueMageia:2 |
before 2.5.12-1.2.mga2 | 2.5.12-1.2.mga2 |
torqueMageia:3 |
before 4.1.5.1-1.2.mga3 | 4.1.5.1-1.2.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4495 is a high vulnerability (CVSS 10.0) in Adaptivecomputing Torque Resource Manager, published November 13, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.27%, the 88th percentile. Fixed in torque 2.4.8+dfsg-9squeeze3.