PT-2022-23889 · Mdaemon Technologies · Mdaemon Securitygateway For Email Servers

Published 2022-08-25 · Updated 2022-08-26 · CVE-2022-37245

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MDaemon Technologies SecurityGateway for Email Servers version 8.5.2

Description The issue is related to Cross Site Scripting (XSS) and can be exploited via the "Blacklist endpoint". This means that an attacker could potentially inject malicious scripts into the webpage, allowing them to steal user data or take control of the user's session.

Recommendations For version 8.5.2, as a temporary workaround, consider restricting access to the Blacklist endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-37245

Affected Products

Mdaemon Securitygateway For Email Servers

References · 5

• 🔥 https://gtn.com.np/wp-content/uploads/2022/07/Stored-Cross-Site-Scripting-XSS-at-Blacklist-endpoint.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2022-37245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37245 · Security Note
• https://files.mdaemon.com/securitygateway/release/relnotes_en.htm · Vendor Advisory
• https://t.me/cvenotify/35149 · Telegram Post