What’s Vulnerable › Vulnerabilities

CVE-2024-3196: MailCleaner SOAP Service dumpConfiguration os command injection

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-04-29 · updated 2026-06-17
• Weakness: CWE-78

Description

A vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Services_silentDump/Services_stopStartMTA/Config_saveDateTime/Config_hostid/Logs_StartGetStat/dumpConfiguration of the component SOAP Service. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262312.

Affected products

• MailCleaner: through 2023.03.14

References

• https://github.com/MailCleaner/MailCleaner/pull/601
• https://modzero.com/en/advisories/mz-24-01-mailcleaner/
• https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
• https://vuldb.com/?ctiid.262312
• https://vuldb.com/?id.262312
• https://github.com/MailCleaner/MailCleaner/pull/601
• https://modzero.com/en/advisories/mz-24-01-mailcleaner/
• https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf
• https://vuldb.com/?ctiid.262312
• https://vuldb.com/?id.262312

Get alerted when CVE-2024-3196 or the next vulnerability affects your stack