by Kastro
Paper/Archive/CVE-2024-3191

CVE-2024-3191

mailcleaner mailcleaner — MailCleaner Email os command injection

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 92.4.924 × 2018.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307.

Affected

ProductAffectedFixed inSource
MailCleaner2023.03.0–CNA
MailCleaner2023.03.1–CNA
MailCleaner2023.03.2–CNA
MailCleaner2023.03.3–CNA
MailCleaner2023.03.4–CNA
MailCleaner2023.03.5–CNA
MailCleaner2023.03.6–CNA
MailCleaner2023.03.7–CNA
MailCleaner2023.03.8–CNA
MailCleaner2023.03.9–CNA
MailCleaner2023.03.10–CNA
MailCleaner2023.03.11–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refvuldb.com/?id.262307refvuldb.com/?ctiid.262307refmodzero.com/en/advisories/mz-24-01-mailcleanerexploitmodzero.com/static/MZ-24-01_modzero_MailCleaner.pdfpatchgithub.com/MailCleaner/MailCleaner/pull/601