« Volver al listado

CVE-2024-5400

Estado: AnalizadaAlta (8.8)—

Openfind Mail2000 does not properly filter parameters of specific CGI. Remote attackers with regular privileges can exploit this vulnerability to execute arbitrary system commands on the remote server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openfind — Mail2000

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-5400",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-5400",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-28T11:31:13.350634Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "Openfind",
          "product": "Mail2000 V8.0",
          "versions": [
            {
              "status": "affected",
              "version": "earlier",
              "lessThan": "Patch 34",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:openfind:mail2000:8.0:*:*:*:*:*:*:*"
          ],
          "vendor": "openfind",
          "product": "mail2000",
          "versions": [
            {
              "status": "affected",
              "version": "8.0",
              "lessThan": "8.0_patch_34",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-27T06:15:10.620",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7819-9661a-1.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7819-9661a-1.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Openfind Mail2000 does not properly filter parameters of specific CGI. Remote attackers with regular privileges can exploit this vulnerability to execute arbitrary system commands on the remote server."
    },
    {
      "lang": "es",
      "value": "Openfind Mail2000 no filtra adecuadamente los parámetros de CGI específicos. Los atacantes remotos con privilegios regulares pueden aprovechar esta vulnerabilidad para ejecutar comandos arbitrarios del sistema en el servidor remoto."
    }
  ],
  "lastModified": "2026-06-17T08:15:52.327",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openfind:mail2000:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97249A05-B6F2-4D10-902D-4D1A373F3F90"
            },
            {
              "criteria": "cpe:2.3:a:openfind:mail2000:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1762976A-2372-49D5-BD94-77F8C0C86DC2"
            },
            {
              "criteria": "cpe:2.3:a:openfind:mail2000:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC17A2D8-B006-4738-A6CB-F6B277460B6B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}