PT-2024-24312 · Unknown · Mailcleaner

Michael Imfeld + 1 · Published 2024-04-28 · Updated 2025-03-21 · CVE-2024-3195

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MailCleaner versions up to 2023.03.14

Description A critical issue affects an unknown part of the component Admin Endpoints, leading to path traversal. The manipulation can be initiated remotely. The issue has been disclosed publicly and may be exploited.

Recommendations Apply a patch to fix this issue for versions up to 2023.03.14. As a temporary workaround, consider restricting access to the Admin Endpoints until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-3195

Affected Products

Mailcleaner

References · 11

• 🔥 https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf · Exploit
• https://github.com/MailCleaner/MailCleaner/pull/601 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-3195 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3195 · Vendor Advisory
• https://modzero.com/en/advisories/mz-24-01-mailcleaner · Note
• https://t.me/cvenotify/78330 · Telegram Post
• https://t.me/cvenotify/115692 · Telegram Post
• https://twitter.com/CVEnew/status/1784834862899445897 · Twitter Post
• https://vuldb.com/?id.262311 · Note
• https://t.me/secharvester/16474 · Telegram Post
• https://vuldb.com/?ctiid.262311 · Note