mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation
CVE-2023-49077

6.1MEDIUM

Key Information:

Vendor

mailcow

Status
mailcow-dockerized
Vendor
CVE Published:
30 November 2023

What is CVE-2023-49077?

Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the Quarantine feature. An attacker can send a carefully crafted email containing malicious JavaScript code. This issue has been patched in version 2023-11.

Affected Version(s)

mailcow-dockerized < 2023-11

References

https://github.com/mailcow/mailcow-dockerized/security/ad...
x_refsource_CONFIRM
https://github.com/mailcow/mailcow-dockerized/releases/ta...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.