« Volver al listado

CVE-2024-5399

Estado: AnalizadaAlta (7.2)—

Openfind Mail2000 does not properly filter parameters of specific API. Remote attackers with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the remote server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openfind — Mail2000

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-5399",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-5399",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-10T17:37:42.572423Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "Openfind",
          "product": "Mail2000 V7.0",
          "versions": [
            {
              "status": "affected",
              "version": "Patch 55",
              "lessThan": "Patch 124",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Openfind",
          "product": "Mail2000 V8.0",
          "versions": [
            {
              "status": "affected",
              "version": "earlier",
              "lessThan": "Patch 31",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-05-27T04:15:09.300",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7817-6ce29-1.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7817-6ce29-1.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Openfind Mail2000 does not properly filter parameters of specific API. Remote attackers with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the remote server."
    },
    {
      "lang": "es",
      "value": "Openfind Mail2000 no filtra correctamente los parámetros de una API específica. Los atacantes remotos con privilegios administrativos pueden aprovechar esta vulnerabilidad para ejecutar comandos arbitrarios del sistema en el servidor remoto."
    }
  ],
  "lastModified": "2026-06-17T08:15:52.197",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openfind:mail2000:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1762976A-2372-49D5-BD94-77F8C0C86DC2"
            },
            {
              "criteria": "cpe:2.3:a:openfind:mail2000:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC17A2D8-B006-4738-A6CB-F6B277460B6B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}