CVE-2024-45438

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided as part of the email parameter, SpamTitan will automatically create a user record and associate quarantine settings with it - all without requiring authentication.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-284CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Aug 21, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-45449.8The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including,CVE-2024-454405.3core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_coCVE-2024-454417.5Input verification vulnerability in the system service module Impact: Successful exploitation of this vulnerability will affect availabilityCVE-2024-454427.5Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability wCVE-2024-454439.1Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnerability will affect availability and confCVE-2024-454445.5Access permission verification vulnerability in the WMS module Impact: Successful exploitation of this vulnerability may affect service confCVE-2024-454455.5Vulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this vulnerability will afCVE-2024-454465.5Access permission verification vulnerability in the camera driver module Impact: Successful exploitation of this vulnerability will affect aCVE-2024-454475.5Access control vulnerability in the camera framework module Impact: Successful exploitation of this vulnerability may affect service confideCVE-2024-454485.5Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may aCVE-2024-454495.5Access permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affectCVE-2024-45457.7All versions of EnterpriseDB Postgres Advanced Server (EPAS) from 15.0 prior to 15.7.0 and from 16.0 prior to 16.3.0 may allow users using e
CVE-2024-45438: Critical severity, CVSS 9.1 | Vulnix