PT-2024-17385 · Surgemail · Surgemail

Alfredo Mariños + 2 · Published 2024-11-29 · Updated 2024-11-29 · CVE-2024-11990

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SurgeMail version v78c2

Description A Cross-Site Scripting (XSS) issue could allow an attacker to execute arbitrary JavaScript code via an elaborate payload injected into vulnerable parameters.

Recommendations For SurgeMail version v78c2, consider disabling access to parameters that could be used to inject malicious JavaScript code until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-11990

Affected Products

Surgemail

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-11990 · Security Note
• https://twitter.com/incibe_cert/status/1862477928136577326 · Twitter Post
• https://t.me/cvenotify/102697 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-netwin-surgemail · Note
• https://twitter.com/CVEnew/status/1862491044161503326 · Twitter Post