PT-2024-5831 · Mailcow · Mailcow

Julian B · Published 2024-08-05 · Updated 2024-09-19 · CVE-2024-41959

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions mailcow: dockerized versions prior to 2024-07

Description The issue allows an unauthenticated attacker to inject a JavaScript payload into the API logs. This payload is executed when the API logs page is viewed, potentially allowing an attacker to run malicious scripts in the context of the user's browser. This could lead to unauthorized actions, data theft, or further exploitation of the affected system.

Recommendations For versions prior to 2024-07, upgrade to the 2024-07 release or later to address the issue. As a temporary workaround, consider restricting access to the API logs page until the upgrade is applied. Avoid viewing the API logs page from an untrusted source to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-06576

CVE-2024-41959

GHSA-V3R3-8F69-PH29

Affected Products

Mailcow

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41959.json · Exploit
• https://github.com/mailcow/mailcow-dockerized/commit/66aa28b5de282fc037e0d2f02fbdc84539b614a1 · Patch
• https://osv.dev/vulnerability/CVE-2024-41959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41959 · Security Note
• https://bdu.fstec.ru/vul/2024-06576 · Security Note
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-jpp8-rhg6-4vvv · Note
• https://github.com/mailcow/mailcow-dockerized/commit/efb2572f0fa57628ad98a76a4ae884a10cac0a1a · Note
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-v3r3-8f69-ph29 · Note
• https://vuldb.com/?id.273655 · Note
• https://t.me/cvedetector/2486 · Telegram Post