CVE-2024-23824: fallo de gravedad media en mailcow-dockerized
mailcow ipixel flood attack leads to Denial of Service in admin page
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.7epss 0.6%
mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the payload has been successfully uploaded in the logo the application goes slow and doesn't respond in the admin page. It is tested on the versions 2023-12a and prior and patched in version 2024-01.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Productos afectados
mailcow · mailcow-dockerizedCVEs relacionadas — mailcow-dockerized
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-30270MEDIUMmailcow Path Traversal and Arbitrary Code Execution VulnerabilityEPSS 27.3%CVE-2026-40871HIGHmailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via APIEPSS 8.6%CVE-2024-31204MEDIUMmailcow Cross-site Scripting Vulnerability via Exception HandlerEPSS 8.2%CVE-2022-31138HIGHOS Command Injection in mailcowEPSS 3.3%CVE-2023-26490HIGHmailcow is vulnerable to shell command injection via xoauth2 authentication in imapsyncEPSS 2.2%CVE-2022-39258HIGHmailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UIEPSS 1.8%