Vulnerability · Published Apr 29, 2024 · Assigned by VulDB

CVE-2024-3194MailCleaner Log File Endpoint cross site scripting

Medium 4.3

In plain English

A medium-severity cross-site scripting in MailCleaner. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 45.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in MailCleaner up to 2023.03.14 and classified as problematic. Affected by this issue is some unknown functionality of the component Log File Endpoint. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-262310 is the identifier assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	MailCleaner	2023.03.02023.03.12023.03.22023.03.32023.03.42023.03.52023.03.62023.03.7

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

VDB-262310 | MailCleaner Log File Endpoint cross site scripting vdb-entry
VDB-262310 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
https://modzero.com/en/advisories/mz-24-01-mailcleaner/ related
https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf exploit
https://github.com/MailCleaner/MailCleaner/pull/601 issue-tracking, patch