A vulnerability was found in MailCleaner (version unknown) and classified as problematic. This issue affects the function allowAction of the file NewslettersController.php. The manipulation as part of a HTTP GET Request leads to a information disclosure vulnerability (Password). Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.

The weakness was shared 07/18/2019. The identification of this vulnerability is CVE-2019-1010246 since 03/20/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

By approaching the search of inurl:NewslettersController.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is able to eliminate this problem.

Productinfo

Name

• MailCleaner

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion