PT-2024-16805 · Unknown · Mdaemon Email Server

Matthieu Faou · Published 2024-11-15 · Updated 2026-05-02 · CVE-2024-11182

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MDaemon Email Server versions prior to 24.5.1c

Description A Cross-Site Scripting (XSS) issue exists where a remote attacker can send an HTML email containing JavaScript within an img tag. This allows the attacker to load arbitrary JavaScript code in the context of a webmail user's browser window. This flaw has been actively exploited by the Russia-linked APT28 group in Operation RoundPress, targeting government and defense organizations across Eastern Europe, Africa, and South America to steal credentials and emails.

Recommendations Update to version 24.5.1c or later.

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-07577

CVE-2024-11182

Affected Products

Mdaemon Email Server

References · 41

• https://nvd.nist.gov/vuln/detail/CVE-2024-11182 · Security Note
• https://bdu.fstec.ru/vul/2025-07577 · Security Note
• https://files.mdaemon.com/mdaemon/beta/RelNotes_en.html · Security Note
• https://osv.dev/vulnerability/CVE-2024-11182 · Vendor Advisory
• https://mdaemon.com/pages/downloads-critical-updates · Security Note
• https://t.me/avleonovcom/1556 · Telegram Post
• https://twitter.com/mayurk21/status/1928378870719537573 · Twitter Post
• https://t.me/aptreports/18687 · Telegram Post
• https://twitter.com/CVEnew/status/1857376444617551930 · Twitter Post
• https://twitter.com/ScyScan/status/1925674155359248529 · Twitter Post
• https://twitter.com/protecticore/status/1926705072215568577 · Twitter Post
• https://twitter.com/TuringCyberObs/status/1923382627823686144 · Twitter Post
• https://twitter.com/scandaletti/status/1929076105874649153 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1923253226037530783 · Twitter Post
• https://twitter.com/ScyScan/status/1924662110572970278 · Twitter Post