CVE-2024-3191 - MailCleaner Email os command injection

Back Back to CVE browser

CRITICAL

MailCleaner Email os command injection

Published Apr 29, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 5.15%

Description

A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307.

Affected products

Vendor n/a Product MailCleaner Default
n/a
- Version
  2023.03.0
  Status
  affected
  Constraints
  -
- Version
  2023.03.1
  Status
  affected
  Constraints
  -
- Version
  2023.03.10
  Status
  affected
  Constraints
  -
- Version
  2023.03.11
  Status
  affected
  Constraints
  -
- Version
  2023.03.12
  Status
  affected
  Constraints
  -
- Version
  2023.03.13
  Status
  affected
  Constraints
  -
- Version
  2023.03.14
  Status
  affected
  Constraints
  -
- Version
  2023.03.2
  Status
  affected
  Constraints
  -
- Version
  2023.03.3
  Status
  affected
  Constraints
  -
- Version
  2023.03.4
  Status
  affected
  Constraints
  -
- Version
  2023.03.5
  Status
  affected
  Constraints
  -
- Version
  2023.03.6
  Status
  affected
  Constraints
  -
- Version
  2023.03.7
  Status
  affected
  Constraints
  -
- Version
  2023.03.8
  Status
  affected
  Constraints
  -
- Version
  2023.03.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

MailCleaner

n/a

Version	Status	Constraints
2023.03.0	affected	-
2023.03.1	affected	-
2023.03.10	affected	-
2023.03.11	affected	-
2023.03.12	affected	-
2023.03.13	affected	-
2023.03.14	affected	-
2023.03.2	affected	-
2023.03.3	affected	-
2023.03.4	affected	-
2023.03.5	affected	-
2023.03.6	affected	-
2023.03.7	affected	-
2023.03.8	affected	-
2023.03.9	affected	-

Vendor Mailcleaner Product Mailcleaner Default
n/a
- Version
  2023.03.0
  Status
  affected
  Constraints
  -
- Version
  2023.03.1
  Status
  affected
  Constraints
  -
- Version
  2023.03.10
  Status
  affected
  Constraints
  -
- Version
  2023.03.11
  Status
  affected
  Constraints
  -
- Version
  2023.03.12
  Status
  affected
  Constraints
  -
- Version
  2023.03.13
  Status
  affected
  Constraints
  -
- Version
  2023.03.14
  Status
  affected
  Constraints
  -
- Version
  2023.03.2
  Status
  affected
  Constraints
  -
- Version
  2023.03.3
  Status
  affected
  Constraints
  -
- Version
  2023.03.4
  Status
  affected
  Constraints
  -
- Version
  2023.03.5
  Status
  affected
  Constraints
  -
- Version
  2023.03.6
  Status
  affected
  Constraints
  -
- Version
  2023.03.7
  Status
  affected
  Constraints
  -
- Version
  2023.03.8
  Status
  affected
  Constraints
  -
- Version
  2023.03.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mailcleaner

n/a

Version	Status	Constraints
2023.03.0	affected	-
2023.03.1	affected	-
2023.03.10	affected	-
2023.03.11	affected	-
2023.03.12	affected	-
2023.03.13	affected	-
2023.03.14	affected	-
2023.03.2	affected	-
2023.03.3	affected	-
2023.03.4	affected	-
2023.03.5	affected	-
2023.03.6	affected	-
2023.03.7	affected	-
2023.03.8	affected	-
2023.03.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (5)

https://github.com/MailCleaner/MailCleaner/pull/601
issue-trackingpatchIssue Tracking
https://modzero.com/en/advisories/mz-24-01-mailcleaner/
relatedThird Party Advisory
https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
exploitThird Party Advisory
https://vuldb.com/?ctiid.262307
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.262307
vdb-entryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/MailCleaner/MailCleaner/pull/601		issue-trackingpatchIssue Tracking
https://modzero.com/en/advisories/mz-24-01-mailcleaner/		relatedThird Party Advisory
https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf		exploitThird Party Advisory
https://vuldb.com/?ctiid.262307		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.262307		vdb-entryThird Party AdvisoryVDB Entry