CVE-2024-6048

Openfind MailGates and MailAudit - OS Command Injection

State: Published
Severity: 9.8 Critical
Published: Jun 17, 2024
Updated: Aug 1, 2024
Reserved: Jun 17, 2024

Description

Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker can exploit this vulnerability to inject system commands and execute them on the remote server.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
MailGates 5.0Openfind	earlier to before Patch 5.2.10.094Affected
MailAudit 5.0Openfind	earlier to before Patch 5.2.10.094Affected
MailGates 6.0Openfind	earlier to before Patch 6.1.7.037Affected
MailAudit 6.0Openfind	earlier to before Patch 6.1.7.037Affected

References

https://www.twcert.org.tw/tw/cp-132-7885-a8013-1.htmlthird-party-advisory
https://www.twcert.org.tw/en/cp-139-7886-20b61-2.htmlthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.