CVE-2024-27448

Severity Score

"-"

*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js writing arbitrary code into the routes.js file.

MailDev 2 hasta 2.1.0 permite la ejecución remota de código a través de un encabezado Content-ID manipulado para un archivo adjunto de correo electrónico, lo que lleva a lib/mailserver.js a escribir código arbitrario en el archivo route.js.

*Credits: N/A

CVSS Scores

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2024-02-26 CVE Reserved
2024-04-05 CVE Published
2024-04-05 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (5)

URL	Tag	Source
https://gist.github.com/stypr/fe2003f00959f7e3d92ab9d5260433f8
https://github.com/Tim-Hoekstra/MailDev-2.1.0-Exploit-RCE
https://github.com/maildev/maildev/issues/467
https://github.com/maildev/maildev/releases
https://intrix.com.au/articles/exposing-major-security-flaw-in-maildev

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
-		-				-		-		-