← Vulnerability feed

Vulnerability record · CVE-2024-3196 · published 29 April 2024

CVE-2024-3196: Mailcleaner os command injection vulnerability

Mailcleaner · Mailcleaner

A vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Services_silentDump/Services_stopStartMTA/Config_saveDateTime/Config_hostid/Logs_StartGetStat/dumpConfiguration of the component SOAP Service. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262312.

6.7 CVSS 3.1 Medium EPSS 1.7% · top 24.4% CWE-78 · OS command injection
6.7CVSS 3.1 base score, v2 6.5
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Services_silentDump/Services_stopStartMTA/Config_saveDateTime/Config_hostid/Logs_StartGetStat/dumpConfiguration of the component SOAP Service. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262312.

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/MailCleaner/MailCleaner/pull/601 Issue Tracking
https://modzero.com/en/advisories/mz-24-01-mailcleaner/ Third Party Advisory
https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf ExploitThird Party Advisory
https://vuldb.com/?ctiid.262312 Permissions RequiredVDB Entry
https://vuldb.com/?id.262312 Third Party AdvisoryVDB Entry
https://github.com/MailCleaner/MailCleaner/pull/601 Issue Tracking
https://modzero.com/en/advisories/mz-24-01-mailcleaner/ Third Party Advisory
https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf ExploitThird Party Advisory
https://vuldb.com/?ctiid.262312 Permissions RequiredVDB Entry
https://vuldb.com/?id.262312 Third Party AdvisoryVDB Entry

Track CVE-2024-3196 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-3191Mailcleaner os command injection vulnerabilityA vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the …EPSS 5.2%9.6CVE-2024-3192Mailcleaner cross-site scripting vulnerabilityA vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Adm…EPSS 1.00%8.8CVE-2024-3193Mailcleaner os command injection vulnerabilityA vulnerability has been found in MailCleaner up to 2023.03.14 and classified as critical. Affected by this vulnerability is an unknown functionality…EPSS 4.2%8.8CVE-2018-20323MailCleaner Community Edition Logs.php OS command injectionMailCleaner Community Edition 2018.08 contains an OS command injection flaw in www/soap/application/MCSoap/Logs.php. A remote attacker can inject com…EPSS 54%analysed7.5CVE-2019-1010246Mailcleaner missing authorization vulnerabilityMailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impac…EPSS 1.4%7.2CVE-2024-3195Mailcleaner path traversal vulnerabilityA vulnerability was found in MailCleaner up to 2023.03.14. It has been classified as critical. This affects an unknown part of the component Admin En…EPSS 0.95%6.1CVE-2024-3194Mailcleaner cross-site scripting vulnerabilityA vulnerability was found in MailCleaner up to 2023.03.14 and classified as problematic. Affected by this issue is some unknown functionality of the …EPSS 0.74%6.1CVE-2018-18635Mailcleaner cross-site scripting vulnerabilitywww/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via …EPSS 0.95%

Source: NIST National Vulnerability Database (record CVE-2024-3196), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.