CVE-2024-3191 is a critical severity (CVSS 9.8) OS command injection in the Email Handler component of MailCleaner, in versions up to 2023.03.14. The record says it can be started remotely and recommends applying a patch. The fixed version was not confirmed, so check the project advisory.
What's affected
MailCleaner up to 2023.03.14. The record points to GitHub pull request 601 in the MailCleaner repository and to modzero advisory MZ-24-01, released April 29, 2024, which covers several MailCleaner issues. The record says an exploit has been disclosed publicly.
We did not confirm a fixed release number from the pages we reviewed. The modzero page we retrieved is a pointer to a PDF report, and the record only says to apply a patch. Treat the fix status as unverified until you check the MailCleaner release notes or the pull request.
Three other CVEs in the same disclosure (CVE-2024-3192, CVE-2024-3193 and CVE-2024-3195) affect the same product and version range, so patch for all of them together.
The weakness class: CWE-78, OS command injection. The NVD record scores it 9.8 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CISA Known Exploited Vulnerabilities status in the record: not listed.
How to check if you're exposed
Find your MailCleaner version in the admin interface or on the host, and compare it with 2023.03.14. If it is that or older, treat the system as affected.
Then check exposure. A mail filtering appliance usually sits at the edge, so confirm which interfaces are reachable from the internet and from untrusted networks, and review whether the admin interface is open beyond administrators.
What to do now
- Read modzero advisory MZ-24-01 and the MailCleaner pull request linked in the record to find the fixed code or release.
- Upgrade MailCleaner to a release that contains the fix, once confirmed.
- Restrict the admin interface to management networks and a VPN.
- Review mail and system logs for unexpected commands or processes on the host.
- Plan for the three related CVEs in the same update.
Why it matters
The class is CWE-78, OS command injection. Input reached a shell command without being neutralized, so the application ended up running something its author did not intend.
Mail gateways are valuable targets: they see every message, they are internet facing, and they often hold credentials for downstream systems. A command injection there deserves a faster patch than its position on a backlog might suggest. Note the record does not list this as exploited in the wild, but it does say an exploit was published.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is this critical when sibling CVEs are medium?
NVD scores CVE-2024-3191 at 9.8 and its siblings lower, for example CVE-2024-3192 (cross site scripting) at 4.3. Command injection that can be started remotely without authentication scores higher than a scripting flaw in the admin interface.
Sources
- modzero advisory MZ-24-01
- References in the NVD record (not individually reviewed): GitHub pull request 601 for MailCleaner and VulDB entry 262307
- Safeguard Gold entry for CVE-2024-3191
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
