{"id":"CVE-2023-50917","aliases":["EUVD-2023-55648","GHSA-3pqp-qx7r-vppf"],"status":"published","title":"MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell...","description":"MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.36874,"percentile":0.98528,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2023-12-15T00:00:00Z","modified":"2026-10-28T02:30:40Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/majordomo_cmd_inject_cve_2023_50917","title":"MajorDoMo Command Injection","type":"exploit","platform":"Linux,Unix","date":"2023-12-15","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/majordomo_cmd_inject_cve_2023_50917"},{"source":"nuclei","id":"CVE-2023-50917","title":"MajorDoMo thumb.php - OS Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50917.yaml"},{"source":"pocgithub","id":"Chocapikk/CVE-2023-50917","title":"Chocapikk/CVE-2023-50917","date":"2023-10-29","url":"https://github.com/Chocapikk/CVE-2023-50917"}],"products":[{"vendor":"mjdm","product":"majordomo"}],"references":[{"url":"https://github.com/sergejey/majordomo/commit/0662e5ebfb133445ff6154b69c61019357092178","tags":["x_transferred","Patch","fix"]},{"url":"https://github.com/sergejey/majordomo/commit/3ec3ffb863ea3c2661ab27d398776c551f4daaac","tags":["x_transferred","Patch","fix"]},{"url":"http://seclists.org/fulldisclosure/2023/Dec/19","tags":["mailing-list","x_transferred","article"]},{"url":"http://packetstormsecurity.com/files/176273/MajorDoMo-Remote-Code-Execution.html","tags":["x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/176669/MajorDoMo-Command-Injection.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50917","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3pqp-qx7r-vppf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50917.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-50917","description":"MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.","status":"published","published":"2023-12-15T00:00:00Z","modified":"2024-08-02T22:23:44.178Z","updated_at":"2026-11-02T14:35:34.923818Z"}],"euvd":[{"id":"EUVD-2023-55648","description":"MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.","status":"published","published":"2023-12-15T00:00:00Z","modified":"2024-08-02T22:23:44Z","updated_at":"2026-11-03T03:26:07.661682Z"}],"ghsa":[{"id":"GHSA-3pqp-qx7r-vppf","title":"MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell...","description":"MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.","status":"published","published":"2023-12-15T18:30:29Z","modified":"2024-01-22T18:31:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:55:27.854531Z"}],"nvd":[{"id":"CVE-2023-50917","description":"MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.","status":"published","published":"2023-12-15T17:15:12.84Z","modified":"2026-06-17T06:40:13.31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:08:56.329586Z"}],"osv":[{"id":"CVE-2023-50917","description":"MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.","status":"published","published":"2023-12-15T00:00:00Z","modified":"2026-10-28T02:30:40.815477742Z","updated_at":"2026-11-02T15:44:35.245372Z"}]}}