Axigen XSS Vulnerability Allows Arbitrary Code Execution and Sensitive Information Theft

CVE-2023-40355

What is CVE-2023-40355?

A Cross Site Scripting (XSS) vulnerability has been identified in specific versions of Axigen Mail Server, allowing authenticated attackers to manipulate web applications by injecting malicious scripts. This flaw arises from the logic for switching between the Standard and Ajax versions of the user interface, which can be exploited to execute arbitrary code. Upon successful exploitation, attackers may gain unauthorized access to sensitive information, potentially compromising user accounts and other critical data. It is crucial for users of affected Axigen versions to apply available patches or upgrades to mitigate the risks associated with this vulnerability.

References