by Kastro
Paper/Archive/CVE-2024-6048

CVE-2024-6048

Openfind MailGates 5.0 — Openfind MailGates and MailAudit - OS Command Injection

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.3.523 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker can exploit this vulnerability to inject system commands and execute them on the remote server.

Affected

ProductAffectedFixed inSource
MailGates 5.0earlier – < Patch 5.2.10.094Patch 5.2.10.094CNA
MailAudit 5.0earlier – < Patch 5.2.10.094Patch 5.2.10.094CNA
MailGates 6.0earlier – < Patch 6.1.7.037Patch 6.1.7.037CNA
MailAudit 6.0earlier – < Patch 6.1.7.037Patch 6.1.7.037CNA
mailgates< 5.2.10.0945.2.10.094CISA-ADP
mailaudit< 5.2.10.0945.2.10.094CISA-ADP
mailgates< 6.1.7.0376.1.7.037CISA-ADP
mailaudit< 6.1.7.0376.1.7.037CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-7885-a8013-1.htmlwriteuptwcert.org.tw/en/cp-139-7886-20b61-2.html