CVE-2024-6048

CRITICAL

Openfind MailGates and MailAudit 5.0 < Patch 5.2.10.094 and 6.0 < Patch 6.1.7.037 - Unauthenticated OS Command Injection

Title source: llm
STIX 2.1

Description

Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker can exploit this vulnerability to inject system commands and execute them on the remote server.

References (2)

Core 2
Core References
Various Sources third-party-advisory
https://www.twcert.org.tw/tw/cp-132-7885-a8013-1.html
Various Sources third-party-advisory
https://www.twcert.org.tw/en/cp-139-7886-20b61-2.html

Scores

CVSS v3 9.8
EPSS 0.0068
EPSS Percentile 47.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-78
Status published
Products (4)
Openfind/MailAudit 5.0 earlier - Patch 5.2.10.094
Openfind/MailAudit 6.0 earlier - Patch 6.1.7.037
Openfind/MailGates 5.0 earlier - Patch 5.2.10.094
Openfind/MailGates 6.0 earlier - Patch 6.1.7.037
Published Jun 17, 2024
Tracked Since Feb 18, 2026