{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3191", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2024-04-02T14:22:37.552Z", "datePublished": "2024-04-29T06:21:47.288Z", "dateUpdated": "2024-08-27T17:34:56.094Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-04-29T06:21:47.288Z"}, "title": "MailCleaner Email os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "CWE-78 OS Command Injection"}]}], "affected": [{"vendor": "n/a", "product": "MailCleaner", "versions": [{"version": "2023.03.0", "status": "affected"}, {"version": "2023.03.1", "status": "affected"}, {"version": "2023.03.2", "status": "affected"}, {"version": "2023.03.3", "status": "affected"}, {"version": "2023.03.4", "status": "affected"}, {"version": "2023.03.5", "status": "affected"}, {"version": "2023.03.6", "status": "affected"}, {"version": "2023.03.7", "status": "affected"}, {"version": "2023.03.8", "status": "affected"}, {"version": "2023.03.9", "status": "affected"}, {"version": "2023.03.10", "status": "affected"}, {"version": "2023.03.11", "status": "affected"}, {"version": "2023.03.12", "status": "affected"}, {"version": "2023.03.13", "status": "affected"}, {"version": "2023.03.14", "status": "affected"}], "modules": ["Email Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307."}, {"lang": "de", "value": "Eine Schwachstelle wurde in MailCleaner bis 2023.03.14 entdeckt. Sie wurde als kritisch eingestuft. Dies betrifft einen unbekannten Teil der Komponente Email Handler. Dank Manipulation mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseSeverity": "CRITICAL"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseSeverity": "CRITICAL"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 10, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "timeline": [{"time": "2024-04-23T00:00:00.000Z", "lang": "en", "value": "Countermeasure disclosed"}, {"time": "2024-04-29T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2024-04-29T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2024-04-29T08:26:26.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Michael Imfeld", "type": "finder"}, {"lang": "en", "value": "Pascal Zenker", "type": "finder"}], "references": [{"url": "https://vuldb.com/?id.262307", "name": "VDB-262307 | MailCleaner Email os command injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.262307", "name": "VDB-262307 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/", "tags": ["related"]}, {"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf", "tags": ["exploit"]}, {"url": "https://github.com/MailCleaner/MailCleaner/pull/601", "tags": ["issue-tracking", "patch"]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:05:07.514Z"}, "title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.262307", "name": "VDB-262307 | MailCleaner Email os command injection", "tags": ["vdb-entry", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.262307", "name": "VDB-262307 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/", "tags": ["related", "x_transferred"]}, {"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf", "tags": ["exploit", "x_transferred"]}, {"url": "https://github.com/MailCleaner/MailCleaner/pull/601", "tags": ["issue-tracking", "patch", "x_transferred"]}]}, {"affected": [{"vendor": "mailcleaner", "product": "mailcleaner", "cpes": ["cpe:2.3:a:mailcleaner:mailcleaner:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2023.03.0", "status": "affected"}, {"version": "2023.03.1", "status": "affected"}, {"version": "2023.03.2", "status": "affected"}, {"version": "2023.03.3", "status": "affected"}, {"version": "2023.03.4", "status": "affected"}, {"version": "2023.03.5", "status": "affected"}, {"version": "2023.03.6", "status": "affected"}, {"version": "2023.03.7", "status": "affected"}, {"version": "2023.03.8", "status": "affected"}, {"version": "2023.03.9", "status": "affected"}, {"version": "2023.03.10", "status": "affected"}, {"version": "2023.03.11", "status": "affected"}, {"version": "2023.03.12", "status": "affected"}, {"version": "2023.03.13", "status": "affected"}, {"version": "2023.03.14", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-30T13:41:22.311410Z", "id": "CVE-2024-3191", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T17:34:56.094Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.262307", "name": "VDB-262307 | MailCleaner Email os command injection", "tags": ["vdb-entry", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.262307", "name": "VDB-262307 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/", "tags": ["related", "x_transferred"]}, {"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf", "tags": ["exploit", "x_transferred"]}, {"url": "https://github.com/MailCleaner/MailCleaner/pull/601", "tags": ["issue-tracking", "patch", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:05:07.514Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3191", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-30T13:41:22.311410Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mailcleaner:mailcleaner:*:*:*:*:*:*:*:*"], "vendor": "mailcleaner", "product": "mailcleaner", "versions": [{"status": "affected", "version": "2023.03.0"}, {"status": "affected", "version": "2023.03.1"}, {"status": "affected", "version": "2023.03.2"}, {"status": "affected", "version": "2023.03.3"}, {"status": "affected", "version": "2023.03.4"}, {"status": "affected", "version": "2023.03.5"}, {"status": "affected", "version": "2023.03.6"}, {"status": "affected", "version": "2023.03.7"}, {"status": "affected", "version": "2023.03.8"}, {"status": "affected", "version": "2023.03.9"}, {"status": "affected", "version": "2023.03.10"}, {"status": "affected", "version": "2023.03.11"}, {"status": "affected", "version": "2023.03.12"}, {"status": "affected", "version": "2023.03.13"}, {"status": "affected", "version": "2023.03.14"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T17:34:49.195Z"}}], "cna": {"title": "MailCleaner Email os command injection", "credits": [{"lang": "en", "type": "finder", "value": "Michael Imfeld"}, {"lang": "en", "type": "finder", "value": "Pascal Zenker"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 10, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "affected": [{"vendor": "n/a", "modules": ["Email Handler"], "product": "MailCleaner", "versions": [{"status": "affected", "version": "2023.03.0"}, {"status": "affected", "version": "2023.03.1"}, {"status": "affected", "version": "2023.03.2"}, {"status": "affected", "version": "2023.03.3"}, {"status": "affected", "version": "2023.03.4"}, {"status": "affected", "version": "2023.03.5"}, {"status": "affected", "version": "2023.03.6"}, {"status": "affected", "version": "2023.03.7"}, {"status": "affected", "version": "2023.03.8"}, {"status": "affected", "version": "2023.03.9"}, {"status": "affected", "version": "2023.03.10"}, {"status": "affected", "version": "2023.03.11"}, {"status": "affected", "version": "2023.03.12"}, {"status": "affected", "version": "2023.03.13"}, {"status": "affected", "version": "2023.03.14"}]}], "timeline": [{"lang": "en", "time": "2024-04-23T00:00:00.000Z", "value": "Countermeasure disclosed"}, {"lang": "en", "time": "2024-04-29T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2024-04-29T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2024-04-29T08:26:26.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.262307", "name": "VDB-262307 | MailCleaner Email os command injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.262307", "name": "VDB-262307 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/", "tags": ["related"]}, {"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf", "tags": ["exploit"]}, {"url": "https://github.com/MailCleaner/MailCleaner/pull/601", "tags": ["issue-tracking", "patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307."}, {"lang": "de", "value": "Eine Schwachstelle wurde in MailCleaner bis 2023.03.14 entdeckt. Sie wurde als kritisch eingestuft. Dies betrifft einen unbekannten Teil der Komponente Email Handler. Dank Manipulation mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 OS Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-04-29T06:21:47.288Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3191", "state": "PUBLISHED", "dateUpdated": "2024-08-27T17:34:56.094Z", "dateReserved": "2024-04-02T14:22:37.552Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2024-04-29T06:21:47.288Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mailcleaner:mailcleaner:*:*:*:*:community:*:*:*", "matchCriteriaId": "35777107-4DDB-468B-9E78-A534A93A3768", "versionEndIncluding": "2023.03.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en MailCleaner hasta 2023.03.14 y clasificada como cr\u00edtica. Este problema afecta un procesamiento desconocido del componente Email Handler. La manipulaci\u00f3n conduce a la inyecci\u00f3n de comandos del sistema operativo. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. Se recomienda aplicar un parche para solucionar este problema. El identificador asociado de esta vulnerabilidad es VDB-262307."}], "id": "CVE-2024-3191", "lastModified": "2025-03-21T17:51:02.543", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-04-29T07:15:07.080", "references": [{"source": "cna@vuldb.com", "tags": ["Issue Tracking"], "url": "https://github.com/MailCleaner/MailCleaner/pull/601"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory"], "url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.262307"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.262307"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://github.com/MailCleaner/MailCleaner/pull/601"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.262307"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.262307"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}