CVE-2024-3196 - MailCleaner SOAP Service dumpConfiguration os command injection

Back Back to CVE browser

MEDIUM

MailCleaner SOAP Service dumpConfiguration os command injection

Published Apr 29, 2024

6.7

MEDIUM

CVSS 3.1

EPSS 1.65%

Description

A vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Services_silentDump/Services_stopStartMTA/Config_saveDateTime/Config_hostid/Logs_StartGetStat/dumpConfiguration of the component SOAP Service. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262312.

Affected products

Vendor n/a Product MailCleaner Default
n/a
- Version
  2023.03.0
  Status
  affected
  Constraints
  -
- Version
  2023.03.1
  Status
  affected
  Constraints
  -
- Version
  2023.03.10
  Status
  affected
  Constraints
  -
- Version
  2023.03.11
  Status
  affected
  Constraints
  -
- Version
  2023.03.12
  Status
  affected
  Constraints
  -
- Version
  2023.03.13
  Status
  affected
  Constraints
  -
- Version
  2023.03.14
  Status
  affected
  Constraints
  -
- Version
  2023.03.2
  Status
  affected
  Constraints
  -
- Version
  2023.03.3
  Status
  affected
  Constraints
  -
- Version
  2023.03.4
  Status
  affected
  Constraints
  -
- Version
  2023.03.5
  Status
  affected
  Constraints
  -
- Version
  2023.03.6
  Status
  affected
  Constraints
  -
- Version
  2023.03.7
  Status
  affected
  Constraints
  -
- Version
  2023.03.8
  Status
  affected
  Constraints
  -
- Version
  2023.03.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

MailCleaner

n/a

Version	Status	Constraints
2023.03.0	affected	-
2023.03.1	affected	-
2023.03.10	affected	-
2023.03.11	affected	-
2023.03.12	affected	-
2023.03.13	affected	-
2023.03.14	affected	-
2023.03.2	affected	-
2023.03.3	affected	-
2023.03.4	affected	-
2023.03.5	affected	-
2023.03.6	affected	-
2023.03.7	affected	-
2023.03.8	affected	-
2023.03.9	affected	-

Vendor Mailcleaner Product Mailcleaner Default
n/a
- Version
  2023.03.0
  Status
  affected
  Constraints
  <=2023.03.14

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mailcleaner

n/a

Version	Status	Constraints
2023.03.0	affected	<=2023.03.14

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (5)

https://github.com/MailCleaner/MailCleaner/pull/601
issue-trackingpatchIssue Tracking
https://modzero.com/en/advisories/mz-24-01-mailcleaner/
relatedThird Party Advisory
https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
exploitThird Party Advisory
https://vuldb.com/?ctiid.262312
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.262312
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/MailCleaner/MailCleaner/pull/601		issue-trackingpatchIssue Tracking
https://modzero.com/en/advisories/mz-24-01-mailcleaner/		relatedThird Party Advisory
https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf		exploitThird Party Advisory
https://vuldb.com/?ctiid.262312		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.262312		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry