{"id":"CVE-2024-3192","aliases":["EUVD-2024-31784","GHSA-xmgc-h398-rg8w"],"status":"published","title":"MailCleaner Admin Interface cross site scripting","description":"A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00995,"percentile":0.62907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-04-29T06:22:37Z","modified":"2026-06-17T07:43:30Z","products":[{"vendor":"mailcleaner","product":"mailcleaner"}],"references":[{"url":"https://vuldb.com/?id.262308","tags":["vdb-entry","technical-description","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?ctiid.262308","tags":["signature","permissions-required","x_transferred","Permissions Required","VDB Entry"]},{"url":"https://modzero.com/en/advisories/mz-24-01-mailcleaner/","tags":["related","x_transferred","Third Party Advisory"]},{"url":"https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf","tags":["exploit","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://github.com/MailCleaner/MailCleaner/pull/601","tags":["issue-tracking","patch","x_transferred","Issue Tracking"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3192"},{"url":"https://modzero.com/en/advisories/mz-24-01-mailcleaner"},{"url":"https://github.com/advisories/GHSA-xmgc-h398-rg8w"}],"sources":{"cve":[{"id":"CVE-2024-3192","title":"MailCleaner Admin Interface cross site scripting","description":"A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308.","status":"published","published":"2024-04-29T06:22:37.114Z","modified":"2024-08-01T20:05:08.206Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"},{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:10.613319Z"}],"euvd":[{"id":"EUVD-2024-31784","description":"A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308.","status":"published","published":"2024-04-29T06:22:37Z","modified":"2024-08-01T20:05:08Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:39.0087Z"}],"ghsa":[{"id":"GHSA-xmgc-h398-rg8w","title":"A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14....","description":"A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308.","status":"published","published":"2024-04-29T09:31:52Z","modified":"2024-04-29T09:31:53Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:57:15.123011Z"}],"nvd":[{"id":"CVE-2024-3192","description":"A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308.","status":"published","published":"2024-04-29T07:15:07.48Z","modified":"2026-06-17T07:43:30.17Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:55.124919Z"}]}}