Vulnerability · Published Apr 29, 2024 · Assigned by VulDB
CVE-2024-3195MailCleaner Admin Endpoints path traversal
Medium 4.7
In plain English
A medium-severity path traversal in MailCleaner. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Official description
A vulnerability was found in MailCleaner up to 2023.03.14. It has been classified as critical. This affects an unknown part of the component Admin Endpoints. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262311.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | MailCleaner | 2023.03.02023.03.12023.03.22023.03.32023.03.42023.03.52023.03.62023.03.7 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
References
- VDB-262311 | MailCleaner Admin Endpoints path traversal vdb-entry
- VDB-262311 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
- https://modzero.com/en/advisories/mz-24-01-mailcleaner/ related
- https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf exploit
- https://github.com/MailCleaner/MailCleaner/pull/601 issue-tracking, patch