PT-2023-31045 · Mailcow · Mailcow

Derlinkman · Published 2023-11-30 · Updated 2023-12-05 · CVE-2023-49077

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Mailcow: dockerized versions prior to 2023-11

Description A Cross-Site Scripting (XSS) issue has been identified within the Quarantine UI of the system, posing a significant threat to administrators who utilize the Quarantine feature. An attacker can send a carefully crafted email containing malicious JavaScript code.

Recommendations For versions prior to 2023-11, update to version 2023-11 to resolve the issue. As a temporary workaround, consider restricting access to the Quarantine UI to minimize the risk of exploitation. Avoid using the Quarantine feature until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-49077

GHSA-46X4-W2FM-5X6G

Affected Products

Mailcow

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49077.json · Exploit
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-46x4-w2fm-5x6g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49077 · Security Note
• https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-11 · Note
• https://t.me/cvenotify/62344 · Telegram Post
• https://t.me/cvenotify/61603 · Telegram Post