CVE-2024-35179

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using `RUN_AS_USER`, the specified user (and therefore, web interface admins) can read arbitrary files as root. This issue affects admins who have set up to run stalwart with `RUN_AS_USER` who handed out admin credentials to the mail server but expect these to only grant access according to the `RUN_AS_USER` and are attacked where the attackers managed to achieve Arbitrary Code Execution using another vulnerability. Version 0.8.0 contains a patch for the issue.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-271

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-35186.5The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and inc CVE-2024-351806.1OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter th CVE-2024-351818.1Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. CVE-2024-351828.1Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. CVE-2024-351834.4wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub CVE-2024-351845.5Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 CVE-2024-351855.3Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service CVE-2024-351868.8gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the wo CVE-2024-351879.1Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-CVE-2024-351896.5Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` CVE-2024-35196.1The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up t CVE-2024-351905.3Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identi