CVE-2024-5399

Openfind Mail2000 - OS Command Injection

State: Published
Severity: 7.2 High
Published: May 27, 2024
Updated: Aug 1, 2024
Reserved: May 27, 2024

Description

Openfind Mail2000 does not properly filter parameters of specific API. Remote attackers with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the remote server.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Mail2000 V7.0Openfind	Patch 55 to before Patch 124Affected
Mail2000 V8.0Openfind	earlier to before Patch 31Affected

References

https://www.twcert.org.tw/tw/cp-132-7817-6ce29-1.htmlthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.