PT-2022-23887 · Mdaemon Technologies · Mdaemon Technologies Securitygateway For Email Servers

Published 2022-08-25 · Updated 2022-08-26 · CVE-2022-37243

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MDaemon Technologies SecurityGateway for Email Servers version 8.5.2

Description The issue concerns a Cross Site Scripting (XSS) vulnerability via the "whitelist endpoint". This means that an attacker could potentially inject malicious scripts into the webpage, which would then be executed by the user's browser. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations For MDaemon Technologies SecurityGateway for Email Servers version 8.5.2, consider restricting access to the whitelist endpoint until a fix is available. As a temporary workaround, avoid using the whitelist endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-37243

Affected Products

Mdaemon Technologies Securitygateway For Email Servers

References · 5

• 🔥 https://gtn.com.np/wp-content/uploads/2022/07/Stored-Cross-Site-Scripting-XSS-at-whitelist-endpoint.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-37243 · Security Note
• https://files.mdaemon.com/securitygateway/release/relnotes_en.htm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37243 · Vendor Advisory
• https://t.me/cibsecurity/48768 · Telegram Post