CVE-2024-3192 (GCVE-0-2024-3192)
Vulnerability from cvelistv5
Published
2024-04-29 06:22
Modified
2024-08-01 20:05
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross Site Scripting
Summary
A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | MailCleaner |
Version: 2023.03.0 Version: 2023.03.1 Version: 2023.03.2 Version: 2023.03.3 Version: 2023.03.4 Version: 2023.03.5 Version: 2023.03.6 Version: 2023.03.7 Version: 2023.03.8 Version: 2023.03.9 Version: 2023.03.10 Version: 2023.03.11 Version: 2023.03.12 Version: 2023.03.13 Version: 2023.03.14 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-3192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-29T16:18:13.981404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:32:27.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:05:08.206Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-262308 | MailCleaner Admin Interface cross site scripting",
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.262308"
},
{
"name": "VDB-262308 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.262308"
},
{
"tags": [
"related",
"x_transferred"
],
"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf"
},
{
"tags": [
"issue-tracking",
"patch",
"x_transferred"
],
"url": "https://github.com/MailCleaner/MailCleaner/pull/601"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"modules": [
"Admin Interface"
],
"product": "MailCleaner",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2023.03.0"
},
{
"status": "affected",
"version": "2023.03.1"
},
{
"status": "affected",
"version": "2023.03.2"
},
{
"status": "affected",
"version": "2023.03.3"
},
{
"status": "affected",
"version": "2023.03.4"
},
{
"status": "affected",
"version": "2023.03.5"
},
{
"status": "affected",
"version": "2023.03.6"
},
{
"status": "affected",
"version": "2023.03.7"
},
{
"status": "affected",
"version": "2023.03.8"
},
{
"status": "affected",
"version": "2023.03.9"
},
{
"status": "affected",
"version": "2023.03.10"
},
{
"status": "affected",
"version": "2023.03.11"
},
{
"status": "affected",
"version": "2023.03.12"
},
{
"status": "affected",
"version": "2023.03.13"
},
{
"status": "affected",
"version": "2023.03.14"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Imfeld"
},
{
"lang": "en",
"type": "finder",
"value": "Pascal Zenker"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in MailCleaner bis 2023.03.14 gefunden. Sie wurde als problematisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Komponente Admin Interface. Mit der Manipulation durch Mail Message kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-29T09:45:06.885Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-262308 | MailCleaner Admin Interface cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.262308"
},
{
"name": "VDB-262308 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.262308"
},
{
"tags": [
"related"
],
"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/"
},
{
"tags": [
"exploit"
],
"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/MailCleaner/MailCleaner/pull/601"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-04-23T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2024-04-29T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-04-29T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-29T11:45:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "MailCleaner Admin Interface cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-3192",
"datePublished": "2024-04-29T06:22:37.114Z",
"dateReserved": "2024-04-02T14:22:39.907Z",
"dateUpdated": "2024-08-01T20:05:08.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://vuldb.com/?id.262308\", \"name\": \"VDB-262308 | MailCleaner Admin Interface cross site scripting\", \"tags\": [\"vdb-entry\", \"technical-description\", \"x_transferred\"]}, {\"url\": \"https://vuldb.com/?ctiid.262308\", \"name\": \"VDB-262308 | CTI Indicators (IOB, IOC, TTP)\", \"tags\": [\"signature\", \"permissions-required\", \"x_transferred\"]}, {\"url\": \"https://modzero.com/en/advisories/mz-24-01-mailcleaner/\", \"tags\": [\"related\", \"x_transferred\"]}, {\"url\": \"https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf\", \"tags\": [\"exploit\", \"x_transferred\"]}, {\"url\": \"https://github.com/MailCleaner/MailCleaner/pull/601\", \"tags\": [\"issue-tracking\", \"patch\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T20:05:08.206Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-3192\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-29T16:18:13.981404Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:23.987Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"MailCleaner Admin Interface cross site scripting\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Michael Imfeld\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Pascal Zenker\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 5, \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:P/A:N\"}}], \"affected\": [{\"vendor\": \"n/a\", \"modules\": [\"Admin Interface\"], \"product\": \"MailCleaner\", \"versions\": [{\"status\": \"affected\", \"version\": \"2023.03.0\"}, {\"status\": \"affected\", \"version\": \"2023.03.1\"}, {\"status\": \"affected\", \"version\": \"2023.03.2\"}, {\"status\": \"affected\", \"version\": \"2023.03.3\"}, {\"status\": \"affected\", \"version\": \"2023.03.4\"}, {\"status\": \"affected\", \"version\": \"2023.03.5\"}, {\"status\": \"affected\", \"version\": \"2023.03.6\"}, {\"status\": \"affected\", \"version\": \"2023.03.7\"}, {\"status\": \"affected\", \"version\": \"2023.03.8\"}, {\"status\": \"affected\", \"version\": \"2023.03.9\"}, {\"status\": \"affected\", \"version\": \"2023.03.10\"}, {\"status\": \"affected\", \"version\": \"2023.03.11\"}, {\"status\": \"affected\", \"version\": \"2023.03.12\"}, {\"status\": \"affected\", \"version\": \"2023.03.13\"}, {\"status\": \"affected\", \"version\": \"2023.03.14\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-04-23T00:00:00.000Z\", \"value\": \"Countermeasure disclosed\"}, {\"lang\": \"en\", \"time\": \"2024-04-29T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2024-04-29T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2024-04-29T11:45:07.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/?id.262308\", \"name\": \"VDB-262308 | MailCleaner Admin Interface cross site scripting\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/?ctiid.262308\", \"name\": \"VDB-262308 | CTI Indicators (IOB, IOC, TTP)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://modzero.com/en/advisories/mz-24-01-mailcleaner/\", \"tags\": [\"related\"]}, {\"url\": \"https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf\", \"tags\": [\"exploit\"]}, {\"url\": \"https://github.com/MailCleaner/MailCleaner/pull/601\", \"tags\": [\"issue-tracking\", \"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308.\"}, {\"lang\": \"de\", \"value\": \"Es wurde eine Schwachstelle in MailCleaner bis 2023.03.14 gefunden. Sie wurde als problematisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Komponente Admin Interface. Mit der Manipulation durch Mail Message kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \\u00fcber das Netzwerk erfolgen. Der Exploit steht zur \\u00f6ffentlichen Verf\\u00fcgung. Als bestm\\u00f6gliche Massnahme wird Patching empfohlen.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Cross Site Scripting\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2024-04-29T09:45:06.885Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-3192\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T20:05:08.206Z\", \"dateReserved\": \"2024-04-02T14:22:39.907Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2024-04-29T06:22:37.114Z\", \"assignerShortName\": \"VulDB\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…