CVE-2024-3193 MailCleaner Admin Endpoints os command injection

What is CVE-2024-3193?

CVE-2024-3193 is a high-severity command injection vulnerability in MailCleaner, published on 29 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability has been found in MailCleaner up to 2023.03.14 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Admin Endpoints. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-262309 was assigned to this vulnerability.

Weakness: CWE-78

Which versions are affected by CVE-2024-3193?

It affects 1 product.

Products include Mailcleaner Mailcleaner.

How do I fix CVE-2024-3193?

No fix has been published for CVE-2024-3193 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-3193 being exploited?

There is no known exploitation of CVE-2024-3193 in the wild and no public exploit code.

Other vulnerabilities in MailCleaner

• CVE-2024-3191 MailCleaner Email os command injection Critical 9.8
• CVE-2018-20323 Command injection in n/a High 8.8
• CVE-2019-1010246 Information disclosure in MailCleaner High 7.5
• CVE-2024-3196 MailCleaner SOAP Service dumpConfiguration os command injection Medium 6.7
• CVE-2018-18635 Cross-site scripting in n/a Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qqfg-7xr5-8hvg.