CVE-2024-31204

{"id": "CVE-2024-31204", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.9}]}, "published": "2024-04-04T21:15:16.773", "references": [{"url": "https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-fp6h-63w4-5hcm", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.sonarsource.com/blog/remote-code-execution-in-mailcow-always-sanitize-error-messages", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-fp6h-63w4-5hcm", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vicarius.io/vsociety/posts/mailcow-with-xss-and-path-traversal-cve-2024-31204-and-cve-2024-30270", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEV_MODE. The system saves exception details into a session array without proper sanitization or encoding. These details are later rendered into HTML and executed in a JavaScript block within the user's browser, without adequate escaping of HTML entities. This flaw allows for Cross-Site Scripting (XSS) attacks, where attackers can inject malicious scripts into the admin panel by triggering exceptions with controlled input. The exploitation method involves using any function that might throw an exception with user-controllable argument. This issue can lead to session hijacking and unauthorized administrative actions, posing a significant security risk. Version 2024-04 contains a fix for the issue."}, {"lang": "es", "value": "mailcow: dockerized es un software colaborativo/paquete de correo electr\u00f3nico de c\u00f3digo abierto basado en Docker. Se ha identificado una vulnerabilidad de seguridad en mailcow que afecta a versiones anteriores a 2024-04. Esta vulnerabilidad reside en el mecanismo de manejo de excepciones, espec\u00edficamente cuando no se opera en DEV_MODE. El sistema guarda los detalles de la excepci\u00f3n en una matriz de sesiones sin una desinfecci\u00f3n o codificaci\u00f3n adecuada. Estos detalles luego se representan en HTML y se ejecutan en un bloque de JavaScript dentro del navegador del usuario, sin un escape adecuado de las entidades HTML. Esta falla permite ataques de Cross-Site Scripting (XSS), donde los atacantes pueden inyectar scripts maliciosos en el panel de administraci\u00f3n activando excepciones con entradas controladas. El m\u00e9todo de explotaci\u00f3n implica el uso de cualquier funci\u00f3n que pueda generar una excepci\u00f3n con un argumento controlable por el usuario. Este problema puede provocar secuestro de sesi\u00f3n y acciones administrativas no autorizadas, lo que supone un riesgo de seguridad importante. La versi\u00f3n 2024-04 contiene una soluci\u00f3n para el problema."}], "lastModified": "2025-10-06T15:31:31.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mailcow:mailcow\\:_dockerized:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F64C0C1-1769-4D06-B937-86C8B6F14C50", "versionEndExcluding": "2024-04"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}