CVE-2024-6048 describes a critical command injection vulnerability in Openfind MailGates and MailAudit products, stemming from insufficient input filtering during email attachment analysis. An unauthenticated remote attacker can exploit this flaw to execute arbitrary system commands on the affected server, leading to complete compromise (CVSS 9.8). While currently lacking public exploit code, Metasploit modules, or significant community discussion, its high severity and remote exploitability warrant immediate attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Openfind | MailAudit 5.0 | >= earlier, < Patch 5.2.10.094CNA affecteddefault unaffected | |
| Openfind | MailAudit 6.0 | >= earlier, < Patch 6.1.7.037CNA affecteddefault unaffected | |
| Openfind | MailGates 5.0 | >= earlier, < Patch 5.2.10.094CNA affecteddefault unaffected | |
| Openfind | MailGates 6.0 | >= earlier, < Patch 6.1.7.037CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.