PT-2024-34350 · Axigen · Axigen Mail Server

Clément Lecigne · Published 2024-11-11 · Updated 2024-11-12 · CVE-2024-50601

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Axigen Mail Server versions prior to 10.5.29

Description: The issue concerns persistent and reflected XSS vulnerabilities in the themeMode cookie and h URL parameter. This could allow attackers to execute arbitrary Javascript, potentially leading to session hijacking, data leakage, and further exploitation via a multi-stage attack.

Recommendations: For Axigen Mail Server versions prior to 10.3.3.67, update to version 10.3.3.67 or later. For Axigen Mail Server versions 10.3.3.67 through 10.4.41, update to version 10.4.42 or later. For Axigen Mail Server versions 10.4.42 through 10.5.28, update to version 10.5.29 or later. As a temporary workaround, consider restricting access to the h URL parameter and themeMode cookie to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-50601

Affected Products

Axigen Mail Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-50601 · Security Note
• https://t.me/cvedetector/10553 · Telegram Post
• https://axigen.com/knowledgebase/Axigen-WebMail-Persistent-and-Reflected-XSS-Vulnerabilities-CVE-2024-50601-_403.html · Note
• https://twitter.com/CVEnew/status/1856113440693084317 · Twitter Post