PT-2021-17301 · Mdaemon · Mdaemon

Chudypb · Published 2021-04-14 · Updated 2021-04-21 · CVE-2021-27182

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MDaemon versions prior to 20.0.4

Description: An issue was discovered in the Webmail component of MDaemon, also known as WorldClient. This issue is related to an IFRAME injection, which can be exploited via an email message. It allows an attacker to perform actions with the privileges of the attacked user.

Recommendations: For versions prior to 20.0.4, update to version 20.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Webmail component until the update is applied.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-27182

Affected Products

Mdaemon

References · 5

• 🔥 https://github.com/chudyPB/MDaemon-Advisories · Exploit
• https://osv.dev/vulnerability/CVE-2021-27182 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27182 · Security Note
• https://altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN · Vendor Advisory
• https://t.me/cvenotify/13234 · Telegram Post