CVE-2019-1010246

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-18 · updated 2026-06-17
Weakness: CWE-862

Description

MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.

Affected products

MailCleaner: before 2019-01-21 — fixed in 2019-01-21

How to fix

Upgrade to a fixed version: MailCleaner 2019-01-21. Check the vendor advisory for mitigations.

References

https://github.com/MailCleaner/MailCleaner/commit/c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9
https://github.com/MailCleaner/MailCleaner/commit/c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9

Get alerted when CVE-2019-1010246 or the next vulnerability affects your stack