PT-2024-25166 · Unknown · Ferozo Webmail

Facundo Fernandez · Published 2024-10-18 · Updated 2024-11-19 · CVE-2024-33231

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ferozo Email version 1.1

Description A Cross Site Scripting issue allows a local attacker to execute arbitrary code via a crafted payload to the PDF preview component. This enables the attacker to perform actions on the affected system.

Recommendations For Ferozo Email version 1.1, consider disabling the PDF preview component until a patch is available to prevent exploitation of this issue. Restrict access to the PDF preview functionality to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-33231

Affected Products

Ferozo Webmail

References · 6

• 🔥 https://github.com/fdzdev/CVE-2024-33231 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-33231 · Security Note
• https://t.me/cvedetector/11411 · Telegram Post
• https://t.me/cvenotify/102081 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1847405262644109498 · Twitter Post
• https://twitter.com/CVEnew/status/1858640268897177715 · Twitter Post