Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2000-0352: Pine 4.21 and earlier allows command execution via URL

CVE-2000-0352 · published 26 years ago

Summary

The Pine email program versions before 4.21 can be tricked by a specially crafted web address to run any command on the server. This could let an attacker take control of the system hosting Pine. Upgrade to version 4.21 or later, or apply a patch that correctly sanitizes URLs, to stop the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
university_of_washington	pine	4.20 4.21 `cpe:2.3:a:university_of_washington:pine:4.20:::::::*`

Original advisory text

Pine before version 4.21 does not properly filter shell metacharacters from URLs, which allows remote attackers to execute arbitrary commands via a malformed URL.

References

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

10.0 Critical

Exploitation

3% chance of attack within 30 days

Timeline

Published18 Nov 1999

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2000-0352 · NVD

Track software like this

Free during beta