CVE-2001-1241

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2001-07-17 · updated 2026-06-16

Description

Un-CGI 1.9 and earlier does not verify that a CGI script has the execution bits set before executing it, which allows remote attackers to execute arbitrary commands by directing Un-CGI to a document that begins with "#!" and the desired program name.

Affected products

Steve Grimm Un-Cgi: 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 (+6)

References

http://archives.neohapsis.com/archives/bugtraq/2001-07/0287.html
http://archives.neohapsis.com/archives/bugtraq/2001-07/0349.html
http://www.iss.net/security_center/static/6847.php
http://www.midwinter.com/~koreth/uncgi-changes.html
http://www.midwinter.com/~koreth/uncgi.html
http://www.securityfocus.com/bid/3057
http://archives.neohapsis.com/archives/bugtraq/2001-07/0287.html
http://archives.neohapsis.com/archives/bugtraq/2001-07/0349.html
http://www.iss.net/security_center/static/6847.php
http://www.midwinter.com/~koreth/uncgi-changes.html
http://www.midwinter.com/~koreth/uncgi.html
http://www.securityfocus.com/bid/3057

Get alerted when CVE-2001-1241 or the next vulnerability affects your stack