MDaemon · Email Server

CVE-2024-11182

Stored XSS vulnerability in MDaemon Email Server

Exploited in attacks Medium 5.3 Attack chance: 33%

What it is

An XSS issue was discovered in

MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message
with
JavaScript in an img tag. This could
allow a remote attacker

to load arbitrary JavaScript code in the context of a webmail user's browser window.

CISA: MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: June 9, 2025

Added to the CISA list: May 19, 2025
Published: November 15, 2024
Severity: Medium 5.3 CVSS 4.0
Chance of attacks in the next 30 days (EPSS): 33% in the top 1.6% of all known vulnerabilities
Weakness: CWE-79
More details: NVD · CVE.org · CISA

All references (1)

https://files.mdaemon.com/mdaemon/beta/RelNotes_en.html

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.