CVE-2024-5400

HIGH

Openfind Mail2000 - Authenticated OS Command Injection via CGI Parameter

Title source: llm

Description

Openfind Mail2000 does not properly filter parameters of specific CGI. Remote attackers with regular privileges can exploit this vulnerability to execute arbitrary system commands on the remote server.

References (1)

Core 1

Core References

Vendor Advisory third-party-advisory

https://www.twcert.org.tw/tw/cp-132-7819-9661a-1.html

Scores

CVSS v3 8.8

EPSS 0.0058

EPSS Percentile 43.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (3)

openfind/mail2000 6.0

openfind/mail2000 7.0

openfind/mail2000 8.0

Published May 27, 2024

Tracked Since Feb 18, 2026