CVE-2024-23824: falha de média gravidade em mailcow-dockerized
mailcow ipixel flood attack leads to Denial of Service in admin page
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.7epss 0.6%
mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the payload has been successfully uploaded in the logo the application goes slow and doesn't respond in the admin page. It is tested on the versions 2023-12a and prior and patched in version 2024-01.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
mailcow · mailcow-dockerizedCVEs relacionadas — mailcow-dockerized
No mesmo produto, das mais perigosas para as menos.
CVE-2024-30270MEDIUMmailcow Path Traversal and Arbitrary Code Execution VulnerabilityEPSS 27.3%CVE-2026-40871HIGHmailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via APIEPSS 8.6%CVE-2024-31204MEDIUMmailcow Cross-site Scripting Vulnerability via Exception HandlerEPSS 8.2%CVE-2022-31138HIGHOS Command Injection in mailcowEPSS 3.3%CVE-2023-26490HIGHmailcow is vulnerable to shell command injection via xoauth2 authentication in imapsyncEPSS 2.2%CVE-2022-39258HIGHmailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UIEPSS 1.8%