GitHub_MCVELIST:CVE-2024-30270CVE-2024-30270 mailcow Path Traversal and Arbitrary Code Execution Vulnerability
6.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
6.9 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
10.6%
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, specifically targeting the rspamd_maps() function. It allows authenticated admin users to overwrite any file writable by the www-data user by exploiting improper path validation. The exploit chain can lead to the execution of arbitrary commands on the server. Version 2024-04 contains a patch for the issue.
CNA Affected
[
{
"vendor": "mailcow",
"product": "mailcow-dockerized",
"versions": [
{
"version": "< 2024-04",
"status": "affected"
}
]
}
]Related
6.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
6.9 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
10.6%