Stored XSS Vulnerability in SmarterTools SmarterMail Affected by Malicious SVG Uploads
CVE-2023-48114

5.4MEDIUM

Key Information:

Vendor

Smartertools

Status
Smartermail
Vendor
CVE Published:
21 December 2023

What is CVE-2023-48114?

A vulnerability in SmarterTools SmarterMail versions 8495 to 8664 allows an attacker to upload malicious SVG files that can execute stored XSS through manipulated YouTube URLs. This occurs due to the application's flawed validation of inputs, potentially enabling data theft or unauthorized actions across user sessions. Users should ensure they are using the latest update to mitigate risks associated with this security flaw.

References

https://www.smartertools.com/smartermail/release-notes/cu...
https://co3us.gitbook.io/write-ups/stored-xss-in-email-bo...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.