CVE-2024-3191 - Vulnerability Details - OpenCVE

A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.02447.

Key SSVC decision points have not yet been added.

Vendors	Products
Mailcleaner	Mailcleaner

Configuration 1 [-]

cpe:2.3:a:mailcleaner:mailcleaner:*:*:*:*:community:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/MailCleaner/MailCleaner/pull/601
https://modzero.com/en/advisories/mz-24-01-mailcleaner/
https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
https://vuldb.com/?ctiid.262307
https://vuldb.com/?id.262307

History

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.04784}`	epss `{'score': 0.02937}`

Fri, 21 Mar 2025 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mailcleaner Mailcleaner mailcleaner
CPEs		cpe:2.3:a:mailcleaner:mailcleaner:::::community:::*
Vendors & Products		Mailcleaner Mailcleaner mailcleaner

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2024-04-29T06:21:47.288Z

Updated: 2024-08-27T17:34:56.094Z

Reserved: 2024-04-02T14:22:37.552Z

Link: CVE-2024-3191

Vulnrichment

Updated: 2024-08-01T20:05:07.514Z

NVD

Status : Analyzed

Published: 2024-04-29T07:15:07.080

Modified: 2025-04-11T14:49:53.763

Link: CVE-2024-3191

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3191", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2024-04-02T14:22:37.552Z", "datePublished": "2024-04-29T06:21:47.288Z", "dateUpdated": "2024-08-27T17:34:56.094Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-04-29T06:21:47.288Z"}, "title": "MailCleaner Email os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "CWE-78 OS Command Injection"}]}], "affected": [{"vendor": "n/a", "product": "MailCleaner", "versions": [{"version": "2023.03.0", "status": "affected"}, {"version": "2023.03.1", "status": "affected"}, {"version": "2023.03.2", "status": "affected"}, {"version": "2023.03.3", "status": "affected"}, {"version": "2023.03.4", "status": "affected"}, {"version": "2023.03.5", "status": "affected"}, {"version": "2023.03.6", "status": "affected"}, {"version": "2023.03.7", "status": "affected"}, {"version": "2023.03.8", "status": "affected"}, {"version": "2023.03.9", "status": "affected"}, {"version": "2023.03.10", "status": "affected"}, {"version": "2023.03.11", "status": "affected"}, {"version": "2023.03.12", "status": "affected"}, {"version": "2023.03.13", "status": "affected"}, {"version": "2023.03.14", "status": "affected"}], "modules": ["Email Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307."}, {"lang": "de", "value": "Eine Schwachstelle wurde in MailCleaner bis 2023.03.14 entdeckt. Sie wurde als kritisch eingestuft. Dies betrifft einen unbekannten Teil der Komponente Email Handler. Dank Manipulation mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseSeverity": "CRITICAL"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseSeverity": "CRITICAL"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 10, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "timeline": [{"time": "2024-04-23T00:00:00.000Z", "lang": "en", "value": "Countermeasure disclosed"}, {"time": "2024-04-29T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2024-04-29T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2024-04-29T08:26:26.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Michael Imfeld", "type": "finder"}, {"lang": "en", "value": "Pascal Zenker", "type": "finder"}], "references": [{"url": "https://vuldb.com/?id.262307", "name": "VDB-262307 | MailCleaner Email os command injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.262307", "name": "VDB-262307 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/", "tags": ["related"]}, {"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf", "tags": ["exploit"]}, {"url": "https://github.com/MailCleaner/MailCleaner/pull/601", "tags": ["issue-tracking", "patch"]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:05:07.514Z"}, "title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.262307", "name": "VDB-262307 | MailCleaner Email os command injection", "tags": ["vdb-entry", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.262307", "name": "VDB-262307 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/", "tags": ["related", "x_transferred"]}, {"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf", "tags": ["exploit", "x_transferred"]}, {"url": "https://github.com/MailCleaner/MailCleaner/pull/601", "tags": ["issue-tracking", "patch", "x_transferred"]}]}, {"affected": [{"vendor": "mailcleaner", "product": "mailcleaner", "cpes": ["cpe:2.3:a:mailcleaner:mailcleaner:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2023.03.0", "status": "affected"}, {"version": "2023.03.1", "status": "affected"}, {"version": "2023.03.2", "status": "affected"}, {"version": "2023.03.3", "status": "affected"}, {"version": "2023.03.4", "status": "affected"}, {"version": "2023.03.5", "status": "affected"}, {"version": "2023.03.6", "status": "affected"}, {"version": "2023.03.7", "status": "affected"}, {"version": "2023.03.8", "status": "affected"}, {"version": "2023.03.9", "status": "affected"}, {"version": "2023.03.10", "status": "affected"}, {"version": "2023.03.11", "status": "affected"}, {"version": "2023.03.12", "status": "affected"}, {"version": "2023.03.13", "status": "affected"}, {"version": "2023.03.14", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-30T13:41:22.311410Z", "id": "CVE-2024-3191", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T17:34:56.094Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.262307", "name": "VDB-262307 | MailCleaner Email os command injection", "tags": ["vdb-entry", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.262307", "name": "VDB-262307 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/", "tags": ["related", "x_transferred"]}, {"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf", "tags": ["exploit", "x_transferred"]}, {"url": "https://github.com/MailCleaner/MailCleaner/pull/601", "tags": ["issue-tracking", "patch", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:05:07.514Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3191", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-30T13:41:22.311410Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mailcleaner:mailcleaner:*:*:*:*:*:*:*:*"], "vendor": "mailcleaner", "product": "mailcleaner", "versions": [{"status": "affected", "version": "2023.03.0"}, {"status": "affected", "version": "2023.03.1"}, {"status": "affected", "version": "2023.03.2"}, {"status": "affected", "version": "2023.03.3"}, {"status": "affected", "version": "2023.03.4"}, {"status": "affected", "version": "2023.03.5"}, {"status": "affected", "version": "2023.03.6"}, {"status": "affected", "version": "2023.03.7"}, {"status": "affected", "version": "2023.03.8"}, {"status": "affected", "version": "2023.03.9"}, {"status": "affected", "version": "2023.03.10"}, {"status": "affected", "version": "2023.03.11"}, {"status": "affected", "version": "2023.03.12"}, {"status": "affected", "version": "2023.03.13"}, {"status": "affected", "version": "2023.03.14"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T17:34:49.195Z"}}], "cna": {"title": "MailCleaner Email os command injection", "credits": [{"lang": "en", "type": "finder", "value": "Michael Imfeld"}, {"lang": "en", "type": "finder", "value": "Pascal Zenker"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 10, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "affected": [{"vendor": "n/a", "modules": ["Email Handler"], "product": "MailCleaner", "versions": [{"status": "affected", "version": "2023.03.0"}, {"status": "affected", "version": "2023.03.1"}, {"status": "affected", "version": "2023.03.2"}, {"status": "affected", "version": "2023.03.3"}, {"status": "affected", "version": "2023.03.4"}, {"status": "affected", "version": "2023.03.5"}, {"status": "affected", "version": "2023.03.6"}, {"status": "affected", "version": "2023.03.7"}, {"status": "affected", "version": "2023.03.8"}, {"status": "affected", "version": "2023.03.9"}, {"status": "affected", "version": "2023.03.10"}, {"status": "affected", "version": "2023.03.11"}, {"status": "affected", "version": "2023.03.12"}, {"status": "affected", "version": "2023.03.13"}, {"status": "affected", "version": "2023.03.14"}]}], "timeline": [{"lang": "en", "time": "2024-04-23T00:00:00.000Z", "value": "Countermeasure disclosed"}, {"lang": "en", "time": "2024-04-29T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2024-04-29T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2024-04-29T08:26:26.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.262307", "name": "VDB-262307 | MailCleaner Email os command injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.262307", "name": "VDB-262307 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/", "tags": ["related"]}, {"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf", "tags": ["exploit"]}, {"url": "https://github.com/MailCleaner/MailCleaner/pull/601", "tags": ["issue-tracking", "patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307."}, {"lang": "de", "value": "Eine Schwachstelle wurde in MailCleaner bis 2023.03.14 entdeckt. Sie wurde als kritisch eingestuft. Dies betrifft einen unbekannten Teil der Komponente Email Handler. Dank Manipulation mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 OS Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-04-29T06:21:47.288Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3191", "state": "PUBLISHED", "dateUpdated": "2024-08-27T17:34:56.094Z", "dateReserved": "2024-04-02T14:22:37.552Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2024-04-29T06:21:47.288Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mailcleaner:mailcleaner:*:*:*:*:community:*:*:*", "matchCriteriaId": "35777107-4DDB-468B-9E78-A534A93A3768", "versionEndIncluding": "2023.03.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en MailCleaner hasta 2023.03.14 y clasificada como cr\u00edtica. Este problema afecta un procesamiento desconocido del componente Email Handler. La manipulaci\u00f3n conduce a la inyecci\u00f3n de comandos del sistema operativo. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. Se recomienda aplicar un parche para solucionar este problema. El identificador asociado de esta vulnerabilidad es VDB-262307."}], "id": "CVE-2024-3191", "lastModified": "2025-04-11T14:49:53.763", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-04-29T07:15:07.080", "references": [{"source": "cna@vuldb.com", "tags": ["Issue Tracking"], "url": "https://github.com/MailCleaner/MailCleaner/pull/601"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory"], "url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.262307"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.262307"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://github.com/MailCleaner/MailCleaner/pull/601"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.262307"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.262307"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}