ByteOS Network

NVD Vulnerability Details :

CVE-2024-23824

Analyzed

Source-security-advisories@github.com

Published At-02 Feb, 2024 | 16:15

Updated At-10 Feb, 2024 | 04:04

mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the payload has been successfully uploaded in the logo the application goes slow and doesn't respond in the admin page. It is tested on the versions 2023-12a and prior and patched in version 2024-01.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	2.7	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Secondary	3.1	4.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CPE Matches

mailcow>>mailcow\>>_dockerized

cpe:2.3:a:mailcow:mailcow\:_dockerized:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-400	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/0xbunniee/MailCow-Pixel-Flood-Attack	security-advisories@github.com	Exploit Third Party Advisory
https://github.com/mailcow/mailcow-dockerized/commit/7f6f7e0e9ff608618e5b144bcf18d279610aa3ed	security-advisories@github.com	Patch
https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-45rv-3c5p-w4h7	security-advisories@github.com	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History