CVE-2024-3195 (GCVE-0-2024-3195)
Vulnerability from cvelistv5
Published
2024-04-29 06:22
Modified
2024-08-01 20:05
Severity ?
4.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
4.7 (Medium) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
4.7 (Medium) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Path Traversal
Summary
A vulnerability was found in MailCleaner up to 2023.03.14. It has been classified as critical. This affects an unknown part of the component Admin Endpoints. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262311.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | MailCleaner |
Version: 2023.03.0 Version: 2023.03.1 Version: 2023.03.2 Version: 2023.03.3 Version: 2023.03.4 Version: 2023.03.5 Version: 2023.03.6 Version: 2023.03.7 Version: 2023.03.8 Version: 2023.03.9 Version: 2023.03.10 Version: 2023.03.11 Version: 2023.03.12 Version: 2023.03.13 Version: 2023.03.14 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:mailcleaner:mailcleaner:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mailcleaner",
"vendor": "mailcleaner",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-3195",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-29T11:16:34.962014Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:33:16.869Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:05:07.504Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-262311 | MailCleaner Admin Endpoints path traversal",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://vuldb.com/?id.262311"
},
{
"name": "VDB-262311 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.262311"
},
{
"tags": [
"related",
"x_transferred"
],
"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf"
},
{
"tags": [
"issue-tracking",
"patch",
"x_transferred"
],
"url": "https://github.com/MailCleaner/MailCleaner/pull/601"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"modules": [
"Admin Endpoints"
],
"product": "MailCleaner",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2023.03.0"
},
{
"status": "affected",
"version": "2023.03.1"
},
{
"status": "affected",
"version": "2023.03.2"
},
{
"status": "affected",
"version": "2023.03.3"
},
{
"status": "affected",
"version": "2023.03.4"
},
{
"status": "affected",
"version": "2023.03.5"
},
{
"status": "affected",
"version": "2023.03.6"
},
{
"status": "affected",
"version": "2023.03.7"
},
{
"status": "affected",
"version": "2023.03.8"
},
{
"status": "affected",
"version": "2023.03.9"
},
{
"status": "affected",
"version": "2023.03.10"
},
{
"status": "affected",
"version": "2023.03.11"
},
{
"status": "affected",
"version": "2023.03.12"
},
{
"status": "affected",
"version": "2023.03.13"
},
{
"status": "affected",
"version": "2023.03.14"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Imfeld"
},
{
"lang": "en",
"type": "finder",
"value": "Pascal Zenker"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in MailCleaner up to 2023.03.14. It has been classified as critical. This affects an unknown part of the component Admin Endpoints. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262311."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in MailCleaner bis 2023.03.14 ausgemacht. Sie wurde als kritisch eingestuft. Hiervon betroffen ist ein unbekannter Codeblock der Komponente Admin Endpoints. Mittels dem Manipulieren mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-29T06:22:42.675Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-262311 | MailCleaner Admin Endpoints path traversal",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.262311"
},
{
"name": "VDB-262311 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.262311"
},
{
"tags": [
"related"
],
"url": "https://modzero.com/en/advisories/mz-24-01-mailcleaner/"
},
{
"tags": [
"exploit"
],
"url": "https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/MailCleaner/MailCleaner/pull/601"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-04-23T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2024-04-29T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-04-29T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-29T08:26:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "MailCleaner Admin Endpoints path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-3195",
"datePublished": "2024-04-29T06:22:42.675Z",
"dateReserved": "2024-04-02T14:22:48.769Z",
"dateUpdated": "2024-08-01T20:05:07.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://vuldb.com/?id.262311\", \"name\": \"VDB-262311 | MailCleaner Admin Endpoints path traversal\", \"tags\": [\"vdb-entry\", \"x_transferred\"]}, {\"url\": \"https://vuldb.com/?ctiid.262311\", \"name\": \"VDB-262311 | CTI Indicators (IOB, IOC, TTP)\", \"tags\": [\"signature\", \"permissions-required\", \"x_transferred\"]}, {\"url\": \"https://modzero.com/en/advisories/mz-24-01-mailcleaner/\", \"tags\": [\"related\", \"x_transferred\"]}, {\"url\": \"https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf\", \"tags\": [\"exploit\", \"x_transferred\"]}, {\"url\": \"https://github.com/MailCleaner/MailCleaner/pull/601\", \"tags\": [\"issue-tracking\", \"patch\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T20:05:07.504Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-3195\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-29T11:16:34.962014Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mailcleaner:mailcleaner:*:*:*:*:*:*:*:*\"], \"vendor\": \"mailcleaner\", \"product\": \"mailcleaner\", \"versions\": [{\"status\": \"affected\", \"version\": \"*\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-04-29T11:18:18.444Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"MailCleaner Admin Endpoints path traversal\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Michael Imfeld\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Pascal Zenker\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 5.8, \"vectorString\": \"AV:N/AC:L/Au:M/C:P/I:P/A:P\"}}], \"affected\": [{\"vendor\": \"n/a\", \"modules\": [\"Admin Endpoints\"], \"product\": \"MailCleaner\", \"versions\": [{\"status\": \"affected\", \"version\": \"2023.03.0\"}, {\"status\": \"affected\", \"version\": \"2023.03.1\"}, {\"status\": \"affected\", \"version\": \"2023.03.2\"}, {\"status\": \"affected\", \"version\": \"2023.03.3\"}, {\"status\": \"affected\", \"version\": \"2023.03.4\"}, {\"status\": \"affected\", \"version\": \"2023.03.5\"}, {\"status\": \"affected\", \"version\": \"2023.03.6\"}, {\"status\": \"affected\", \"version\": \"2023.03.7\"}, {\"status\": \"affected\", \"version\": \"2023.03.8\"}, {\"status\": \"affected\", \"version\": \"2023.03.9\"}, {\"status\": \"affected\", \"version\": \"2023.03.10\"}, {\"status\": \"affected\", \"version\": \"2023.03.11\"}, {\"status\": \"affected\", \"version\": \"2023.03.12\"}, {\"status\": \"affected\", \"version\": \"2023.03.13\"}, {\"status\": \"affected\", \"version\": \"2023.03.14\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-04-23T00:00:00.000Z\", \"value\": \"Countermeasure disclosed\"}, {\"lang\": \"en\", \"time\": \"2024-04-29T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2024-04-29T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2024-04-29T08:26:32.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/?id.262311\", \"name\": \"VDB-262311 | MailCleaner Admin Endpoints path traversal\", \"tags\": [\"vdb-entry\"]}, {\"url\": \"https://vuldb.com/?ctiid.262311\", \"name\": \"VDB-262311 | CTI Indicators (IOB, IOC, TTP)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://modzero.com/en/advisories/mz-24-01-mailcleaner/\", \"tags\": [\"related\"]}, {\"url\": \"https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf\", \"tags\": [\"exploit\"]}, {\"url\": \"https://github.com/MailCleaner/MailCleaner/pull/601\", \"tags\": [\"issue-tracking\", \"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability was found in MailCleaner up to 2023.03.14. It has been classified as critical. This affects an unknown part of the component Admin Endpoints. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262311.\"}, {\"lang\": \"de\", \"value\": \"Es wurde eine Schwachstelle in MailCleaner bis 2023.03.14 ausgemacht. Sie wurde als kritisch eingestuft. Hiervon betroffen ist ein unbekannter Codeblock der Komponente Admin Endpoints. Mittels dem Manipulieren mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann \\u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \\u00f6ffentlichen Verf\\u00fcgung. Als bestm\\u00f6gliche Massnahme wird Patching empfohlen.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Path Traversal\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2024-04-29T06:22:42.675Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-3195\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T20:05:07.504Z\", \"dateReserved\": \"2024-04-02T14:22:48.769Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2024-04-29T06:22:42.675Z\", \"assignerShortName\": \"VulDB\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…