CVE-2024-5400

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Openfind Mail2000 does not properly filter parameters of specific CGI. Remote attackers with regular privileges can exploit this vulnerability to execute arbitrary system commands on the remote server.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
OpenfindMail2000 V8.0>= earlier, < Patch 34
openfindmail2000>= 8.0, < 8.0_patch_34

References

Timeline

Published
May 27, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-540007.5Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynaCVE-2024-540015.5Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settingCVE-2024-540025.3Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. PerforCVE-2024-540038.0Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability CVE-2024-540044.3Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, alloCVE-2024-540055.1A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions),CVE-2024-540067.2Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated reCVE-2024-540077.2Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated reCVE-2024-540087.2An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could alCVE-2024-540094.0Remote authentication bypass vulnerability in HPE Alletra Storage MP B10000 in versions prior to version 10.4.5 could be remotely exploited CVE-2024-54018.8Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-CVE-2024-540103.4A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjace