Reflected XSS Vulnerability in MailEnable Address Book Functionality
CVE-2025-34402
5.3MEDIUM
What is CVE-2025-34402?
A reflected cross-site scripting (XSS) vulnerability exists in MailEnable versions before 10.54 that affects the FieldCc parameter of the AddressBook.aspx page. Due to inadequate sanitization of the FieldCc input during GET requests, an attacker can inject malicious JavaScript code into the response returned by the server. This exploit allows a remote attacker to execute arbitrary JavaScript in a victim’s browser when attempting to send an email. Consequences of successful exploitation include the potential for victims to be redirected to harmful sites, theft of non-HttpOnly cookies, and unauthorized actions taken on behalf of the authenticated user.
Affected Version(s)
MailEnable 0 < 10.54
References
CVSS V4
Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
MushroomSecTeam (Spotify, AmirSUN, M30Brad, Hannah Green, av01t3x, PG)