PT-2024-12819 · Easyemail · Easyemail

Chuayupeng · Published 2024-02-08 · Updated 2024-04-30 · CVE-2023-39683

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EasyEmail versions prior to 4.12.2

Description A Cross Site Scripting (XSS) issue allows a local attacker to execute arbitrary code via the user input parameter(s). The researcher claims this issue is present in all versions prior to and later than the tested version.

Recommendations For versions prior to 4.12.2, consider disabling the user input functionality until a patch is available. As a temporary workaround, restrict access to the vulnerable parameter user input parameter(s) to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-39683

Affected Products

Easyemail

References · 10

• 🔥 https://medium.com/%40vificatem/cve-2023-39683-dom-xss-on-json-source-code-panel-in-zalify-easy-email-3fa08f3e0d49 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-39683 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39683 · Vendor Advisory
• https://github.com/zalify/easy-email/issues/321 · Note
• https://github.com/zalify/easy-email/issues/373 · Note
• https://twitter.com/CVEnew/status/1755843404989092147 · Twitter Post
• https://t.me/cvenotify/78621 · Telegram Post
• https://t.me/cvenotify/70776 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1755927296119099843 · Twitter Post
• https://t.me/cvenotify/70814 · Telegram Post