Vulnerability Details : CVE-2018-20323
Public exploit exists!
www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands.
Products affected by CVE-2018-20323
- cpe:2.3:a:mailcleaner:mailcleaner:2018.08:*:*:*:community:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-20323
75.97%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2018-20323
-
Mailcleaner Remote Code Execution
Disclosure Date: 2018-12-19First seen: 2020-04-26exploit/linux/http/mailcleaner_execThis module exploits the command injection vulnerability of MailCleaner Community Edition product. An authenticated user can execute an operating system command under the context of the web server user which is root. /admin/managetracing/search/search endpoint takes several
CVSS scores for CVE-2018-20323
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.0
|
HIGH | AV:N/AC:L/Au:S/C:C/I:C/A:C |
8.0
|
10.0
|
NIST | |
|
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2018-20323
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-20323
-
http://packetstormsecurity.com/files/151056/Mailcleaner-Remote-Code-Execution.html
Mailcleaner Remote Code Execution ≈ Packet StormExploit;VDB Entry;Third Party Advisory
-
https://pentest.blog/advisory-mailcleaner-community-edition-remote-code-execution/
Advisory | MailCleaner Community Edition Remote Code Execution CVE-2018-20323 – Pentest BlogExploit;Third Party Advisory
Jump to