XSS Vulnerability in SurgeMail v78c2 Could Allow Arbitrary JavaScript Code Execution

CVE-2024-11990

4.6MEDIUM

Key Information

Vendor: Netwin
Status: Surgemail
Vendor: CVE Published:; 29 November 2024

Summary

A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate payload injected into vulnerable parameters.

Affected Version(s)

SurgeMail = 78c2

CVSS V3.1

Score:

4.6

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Unchanged

Timeline

Vulnerability Reserved.
Nov 29, 2024
Vulnerability published.
Nov 29, 2024

Collectors

NVD DatabaseMitre Database

Credit

Cristhian Pacherres

Mauricio Jara

Alfredo Mariños