CVE-2003-1426

LowCVSS 3.3/10Last modified Jun 16, 2026

Description

Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to execute arbitrary code by modifying SCRIPT_FILENAME to reference a directory containing a malicious openwebmail-shared.pl executable.

Metrics

CVSS 2.0 3.3/10AV:L/AC:M/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-16

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 31, 2003
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2003

CVE-2003-14276.4Directory traversal vulnerability in the web configuration interface in Netgear FM114P 1.4 allows remote attackers to read arbitrary files, CVE-2003-14284.8Gallery 1.3.3 creates directories with insecure permissions, which allows local users to read, modify, or delete photos.CVE-2003-14297.5Buffer overflow in Proxomitron Naoko 4.4 allows remote attackers to execute arbitrary code via a long request.CVE-2003-14305.0Directory traversal vulnerability in Unreal Tournament Server 436 and earlier allows remote attackers to access known files via a ".." (dot CVE-2003-14317.1Buffer overflow in Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host stCVE-2003-143210.0Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execuCVE-2003-14334.3Epic Games Unreal Engine 226f through 436 does not validate the challenge key, which allows remote attackers to exhaust the player limit by CVE-2003-14346.8login_ldap 3.1 and 3.2 allows remote attackers to initiate unauthenticated bind requests if (1) bind_anon_dn is on, which allows a bind withCVE-2003-14357.5SQL injection vulnerability in PHP-Nuke 5.6 and 6.0 allows remote attackers to execute arbitrary SQL commands via the days parameter to the CVE-2003-14366.8PHP remote file inclusion vulnerability in nukebrowser.php in Nukebrowser 2.1 to 2.5 allows remote attackers to execute arbitrary PHP code vCVE-2003-14372.1BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trCVE-2003-14384.3Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful sessi
CVE-2003-1426: Low severity, CVSS 3.3 | Vulnix