PT-2024-23848 · Mailcow · Mailcow

Alchemist

·

Published

2024-04-04

·

Updated

2025-10-06

·

CVE-2024-31204

CVSS v3.1

6.1

Medium

VectorAV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions mailcow versions prior to 2024-04
Description A security issue has been identified in the exception handling mechanism of mailcow, specifically when not operating in DEV MODE. The system saves exception details into a session array without proper sanitization or encoding, which are later rendered into HTML and executed in a JavaScript block within the user's browser without adequate escaping of HTML entities. This allows for Cross-Site Scripting (XSS) attacks, where attackers can inject malicious scripts into the admin panel by triggering exceptions with controlled input, potentially leading to session hijacking and unauthorized administrative actions.
Recommendations For versions prior to 2024-04, update to version 2024-04 to resolve the issue. As a temporary workaround, consider restricting access to functions that might throw exceptions with user-controllable arguments until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-31204
GHSA-FP6H-63W4-5HCM

Affected Products

Mailcow