CVE-2024-11182

Description

An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.

Reserved 2024-11-13 | Published 2024-11-15 | Updated 2025-05-21 | Assigner ESET

CISA Known Exploited Vulnerability

Date added 2025-05-19 | Due date 2025-06-09

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unaffected

Any version
affected

24.5.1
unaffected

Credits

Matthieu Faou (ESET) finder

References

files.mdaemon.com/mdaemon/beta/RelNotes_en.html

cve.org (CVE-2024-11182)

nvd.nist.gov (CVE-2024-11182)

Download JSON