by Kastro
Paper/Archive/CVE-2024-3192

CVE-2024-3192

VulDB — MailCleaner Admin Interface cross site scripting

EPSS 1.0%CVSS 9.6
critical.is priorityof 100
41
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 62.7.627 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308.

Affected

ProductAffectedFixed inSource
MailCleaner2023.03.0–CNA
MailCleaner2023.03.1–CNA
MailCleaner2023.03.2–CNA
MailCleaner2023.03.3–CNA
MailCleaner2023.03.4–CNA
MailCleaner2023.03.5–CNA
MailCleaner2023.03.6–CNA
MailCleaner2023.03.7–CNA
MailCleaner2023.03.8–CNA
MailCleaner2023.03.9–CNA
MailCleaner2023.03.10–CNA
MailCleaner2023.03.11–CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
VulDB (CNA)4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
VulDB (CNA)4.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.262308refvuldb.com/?ctiid.262308refmodzero.com/en/advisories/mz-24-01-mailcleanerexploitmodzero.com/static/MZ-24-01_modzero_MailCleaner.pdfpatchgithub.com/MailCleaner/MailCleaner/pull/601