CVE-2024-3193 is a high severity (CVSS 8.8) OS command injection in the Admin Endpoints of MailCleaner, in versions up to 2023.03.14. The record says it can be launched remotely. The fixed version was not confirmed from the pages we reviewed, so check the project advisory and patch.
What's affected
MailCleaner up to 2023.03.14. The record references GitHub pull request 601 and modzero advisory MZ-24-01, released April 29, 2024. It says an exploit has been disclosed publicly.
The vector requires low privileges (PR:L in the vector), so an attacker needs some access to the admin endpoints first. That is lower than the unauthenticated case in CVE-2024-3191, but admin accounts and stolen credentials are common enough that you should not rely on it.
The weakness class: CWE-78, OS command injection. The NVD record scores it 8.8 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the description says classified as critical (VulDB wording), while NVD scores this 8.8, which is High. Both are published. Use the NVD score for your risk matrix and the vendor guidance for the fix.
How to check if you're exposed
Confirm the MailCleaner version and compare with 2023.03.14. Then list who holds admin accounts and how they authenticate, since the vector needs an authenticated user. Check that the admin interface is not reachable from the internet.
What to do now
- Locate the fix in the pull request or release notes and upgrade to a release that includes it.
- Restrict and audit admin access, and use strong unique credentials.
- Review host logs for unexpected processes started by the web application.
- Patch with CVE-2024-3191, CVE-2024-3192 and CVE-2024-3195.
Why it matters
This is CWE-78, OS command injection, again. The record lists it twice, which is a data quirk. Shell commands built from request data are a dependable source of serious bugs because the damage is limited only by what the service account can do.
Because an account is needed, the main threat is credential theft or abuse by an insider. Network restrictions on the admin interface and good account hygiene reduce that risk until the patch is in.
Quick check
Why is the admin endpoint bug rated lower than the email handler one?
CVE-2024-3193 needs a privileged account (PR:L), so it scores 8.8. CVE-2024-3191 scores 9.8, which fits an attack that needs no privileges. Both involve command injection and both should be patched.
Sources
- modzero advisory MZ-24-01
- References in the NVD record (not individually reviewed): GitHub pull request 601 for MailCleaner and VulDB entry 262309
- Safeguard Gold entry for CVE-2024-3193
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
