CVE-2024-3192 is a medium severity (CVSS 4.3) cross site scripting flaw in the Admin Interface of MailCleaner, in versions up to 2023.03.14. It involves a mail message and can be triggered remotely. The fixed version was not confirmed, so check the project advisory and apply the patch.
What's affected
MailCleaner up to 2023.03.14. The record points to GitHub pull request 601 and to modzero advisory MZ-24-01, released April 29, 2024. The description says the manipulation happens as part of a mail message, which means content in an email can reach the admin interface.
The record says a public exploit exists. We did not confirm a fixed release from the pages reviewed, so verify with the project.
The weakness class: CWE-79, cross site scripting. The NVD record scores it 4.3 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the description text calls the issue problematic, and NVD scores it 4.3 (Medium). Those line up. For other CVEs in the same disclosure the descriptions say critical while NVD scores are lower, which is noted in those posts.
How to check if you're exposed
Check the MailCleaner version in the admin interface and compare with 2023.03.14. Anything at or below it is in range.
Also review who can open the admin interface and from where. Cross site scripting in an admin page matters most when administrators browse it from the same machine they use for everything else.
What to do now
- Check the MailCleaner pull request and advisory for the fix and move to a release that includes it.
- Restrict admin interface access to management networks.
- Ask administrators to use a dedicated browser profile for the console.
- Patch the related issues (CVE-2024-3191, CVE-2024-3193, CVE-2024-3195) in the same change.
Why it matters
Cross site scripting, CWE-79, lets attacker supplied content run in the browser of a person using the application. Here the content arrives in an email, which is a channel the attacker controls without needing any account.
The medium score reflects limited direct impact and a need for user interaction. In an admin console, though, the browser session carries high privilege, so the practical risk is higher than the number suggests. Patch it alongside the more serious command injection issues.
Quick check
Is cross site scripting in an admin interface really low risk?
Not always. The score is medium, but admin sessions have broad rights, so script running in an administrator browser can do a lot. Treat it as a reason to patch with the rest of the MailCleaner batch.
Sources
- modzero advisory MZ-24-01
- References in the NVD record (not individually reviewed): GitHub pull request 601 for MailCleaner and VulDB entry 262308
- Safeguard Gold entry for CVE-2024-3192
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
