Vulnerability · Published Apr 29, 2024 · Assigned by VulDB

CVE-2024-3196MailCleaner SOAP Service dumpConfiguration os command injection

Medium 6.7

In plain English

A medium-severity OS command injection in MailCleaner. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)1.7%top 23.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Services_silentDump/Services_stopStartMTA/Config_saveDateTime/Config_hostid/Logs_StartGetStat/dumpConfiguration of the component SOAP Service. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262312.

Affected products (as reported)

Vendor	Product	Versions
n/a	MailCleaner	2023.03.02023.03.12023.03.22023.03.32023.03.42023.03.52023.03.62023.03.7

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

VDB-262312 | MailCleaner SOAP Service dumpConfiguration os command injection vdb-entry, technical-description
VDB-262312 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
https://modzero.com/en/advisories/mz-24-01-mailcleaner/ related
https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf exploit
https://github.com/MailCleaner/MailCleaner/pull/601 issue-tracking, patch