CVE-2024-11182: medium-severity vulnerability in MDaemon Email Server
Stored XSS vulnerability in MDaemon Email Server
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
MDaemon Email Server before version 24.5.1c allows attackers to send malicious HTML emails with JavaScript code hidden in image tags. When a webmail user opens such an email, the attacker's script runs in their browser, potentially stealing login credentials or performing unauthorized actions.
Stored XSS vulnerability in MDaemon Email Server's webmail interface via unsanitized HTML email content, specifically JavaScript embedded in img tag attributes. Attack vector requires user interaction (opening email), but persistence is achieved through stored malicious email; successful exploitation grants attacker session access and ability to perform actions as the victim user.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.