LiveActive security incident?Get immediate response
CVE Record

CVE-2019-1010246: MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database...

MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

MailCleaner versions before the fixed commit could expose MySQL database password information to an unauthenticated requester over HTTP. For executives, the business risk is credential leakage that may enable access to sensitive mail-filtering data. The source does not provide CVSS, affected release numbers, or evidence of active exploitation.

Executive priority

Treat as a high-priority remediation for exposed MailCleaner systems because the source describes unauthenticated database credential disclosure. Priority may be lower for isolated systems already patched or not reachable by untrusted users.

Technical view

CVE-2019-1010246 affects MailCleaner before commit c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9. The vulnerable component is an API call in allowAction() in NewslettersController.php. The stated attack vector is an HTTP GET request, and the impact is MySQL database content disclosure, including usernames and passwords.

Likely exposure

Exposure is most likely for MailCleaner deployments running code before commit c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 with the affected web/API surface reachable by untrusted users.

Exploitation context

The supplied sources do not show CISA KEV listing, public exploitation, or exploit availability. They do state unauthenticated HTTP GET as the attack vector, which increases urgency where exposed instances exist.

Researcher notes

The bundle lacks CVSS, CWE, exact release names, endpoint details, and exploit telemetry. Analysis should therefore avoid assuming broader product impact. Key validation is version or commit presence plus exposure of the affected HTTP-accessible API path.

Mitigation direction

  • Upgrade MailCleaner to a build containing commit c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.
  • Restrict access to MailCleaner web/API interfaces while patch status is confirmed.
  • Rotate MySQL credentials if vulnerable exposure was possible.
  • Review MailCleaner and database logs for unusual unauthenticated API access.
  • Check MailCleaner vendor guidance for additional remediation.

Validation and detection

  • Confirm the deployed MailCleaner code includes the fixed commit.
  • Identify whether the affected web/API interface is reachable from untrusted networks.
  • Check logs for suspicious requests to newsletter-related API functionality.
  • Verify MySQL credentials were rotated after any plausible exposure.
  • Document affected asset status and remediation evidence.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-1010246 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
MailCleanerMailCleanerbefore c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 [fixed: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9]Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.