Stored XSS Vulnerability in SmarterMail by SmarterTools
CVE-2023-48116

5.4MEDIUM

Key Information:

Vendor

Smartertools

Status
Smartermail
Vendor
CVE Published:
21 December 2023

What is CVE-2023-48116?

An issue in SmarterMail versions 8495 to 8664 allows attackers to exploit a stored cross-site scripting vulnerability. This can be accomplished by crafting a malicious description for a calendar appointment, which when accessed, could execute arbitrary scripts in the context of the user's session. It is essential for SmarterMail users to apply the update to version 8747 or later to mitigate this risk effectively.

References

https://www.smartertools.com/smartermail/release-notes/cu...
https://co3us.gitbook.io/write-ups/stored-xss-in-calendar...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.