Vulnerability · Published Apr 29, 2024 · Assigned by VulDB
CVE-2024-3193MailCleaner Admin Endpoints os command injection
High 8.8
In plain English
A high-severity OS command injection in MailCleaner. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities).
Official description
A vulnerability has been found in MailCleaner up to 2023.03.14 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Admin Endpoints. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-262309 was assigned to this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | MailCleaner | 2023.03.02023.03.12023.03.22023.03.32023.03.42023.03.52023.03.62023.03.7 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- VDB-262309 | MailCleaner Admin Endpoints os command injection vdb-entry
- VDB-262309 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
- https://modzero.com/en/advisories/mz-24-01-mailcleaner/ related
- https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf exploit
- https://github.com/MailCleaner/MailCleaner/pull/601 issue-tracking, patch