CVE-2017-5613
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary...
CVE-2017-5613 is a high vulnerability (CVSS 7.8) in Cpanel Cgiecho, published March 3, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.56%, the 85th percentile. Fixed in cgiemail 1.6-37+deb7u1.
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.
- Record
CVE-2017-5613- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.
- Record
CVE-2017-5613- Updated
- 2026-11-02
EUVDEUVD-2017-14711 No score
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.
- Record
EUVD-2017-14711- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gh36-xvm9-3hm2
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary...
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.
- Record
GHSA-gh36-xvm9-3hm2- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-134
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5613
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.
- Record
UBUNTU-CVE-2017-5613- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cgiemailDebian:7 |
before 1.6-37+deb7u1, plus listed versions 1.6-37 |
1.6-37+deb7u1 |
cgiemailUbuntu:14.04:LTS |
before 1.6-37+deb7u1build0.14.04.1, plus listed versions 1.6-37 |
1.6-37+deb7u1build0.14.04.1 |
cgiemailUbuntu:16.04:LTS |
before 1.6-37+deb7u1build0.16.04.1, plus listed versions 1.6-37 |
1.6-37+deb7u1build0.16.04.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/95870
news.cpanel.com/tsr-2017-0001-full-disclosure
openwall.com/lists/oss-security/2017/01/28/8
nvd.nist.gov/vuln/detail/CVE-2017-5613
github.com/advisories/GHSA-gh36-xvm9-3hm2
ubuntu.com/security/CVE-2017-5613
cve.org/CVERecord?id=CVE-2017-5613