CVE-2024-3196

A vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Services_silentDump/Services_stopStartMTA/Config_saveDateTime/Config_hostid/Logs_StartGetStat/dumpConfiguration of the component SOAP Service. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262312.

CVSS v3 6.7 MEDIUM
CVSS v2.0 6.5 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:M/C:C/I:C/A:C

Exploitability : 2.5 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/MailCleaner/MailCleaner/pull/601
https://modzero.com/en/advisories/mz-24-01-mailcleaner/
https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
https://vuldb.com/?ctiid.262312
https://vuldb.com/?id.262312
https://github.com/MailCleaner/MailCleaner/pull/601
https://modzero.com/en/advisories/mz-24-01-mailcleaner/
https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
https://vuldb.com/?ctiid.262312
https://vuldb.com/?id.262312

Configurations

No configuration.

History

21 Nov 2024, 09:29

Type	Values Removed	Values Added
References	~~() https://github.com/MailCleaner/MailCleaner/pull/601 -~~	() https://github.com/MailCleaner/MailCleaner/pull/601 -
References	~~() https://modzero.com/en/advisories/mz-24-01-mailcleaner/ -~~	() https://modzero.com/en/advisories/mz-24-01-mailcleaner/ -
References	~~() https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf -~~	() https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf -
References	~~() https://vuldb.com/?ctiid.262312 -~~	() https://vuldb.com/?ctiid.262312 -
References	~~() https://vuldb.com/?id.262312 -~~	() https://vuldb.com/?id.262312 -

14 May 2024, 15:40

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en MailCleaner hasta 2023.03.14. Ha sido declarada crítica. Esta vulnerabilidad afecta a la función getStats/Services_silentDump/Services_stopStartMTA/Config_saveDateTime/Config_hostid/Logs_StartGetStat/dumpConfiguration del componente SOAP Service. La manipulación conduce a la inyección de comandos del sistema operativo. Se requiere acceso local para abordar este ataque. El exploit ha sido divulgado al público y puede utilizarse. Se recomienda aplicar un parche para solucionar este problema. El identificador de esta vulnerabilidad es VDB-262312.

29 Apr 2024, 10:15

Type	Values Removed	Values Added
Summary	(en) A vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects unknown code of the file /mailcleaner.php/getStats of the component SOAP Service. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262312.	(en) A vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Services_silentDump/Services_stopStartMTA/Config_saveDateTime/Config_hostid/Logs_StartGetStat/dumpConfiguration of the component SOAP Service. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262312.

29 Apr 2024, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-04-29 07:15

Updated : 2024-11-21 09:29

NVD link : CVE-2024-3196

Mitre link : CVE-2024-3196

CVE.ORG link : CVE-2024-3196

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

6.7 /10