Medium severity · published Feb 3, 2021
CVE-2020-18723
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to…
5.4
CVSS
3.8%
EPSS
No
On KEV
Description
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
Mdaemon Webmail · Altn
before 20.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-18723
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-18723
Exploit
http://kailashbohara.com.np/blog/2020/07/15/mdaemon-stored-xss
Exploit
http://packetstormsecurity.com/files/161332/Alt-N-MDaemon-Webmail-20.0.0-Cross-Site-Scripting.html
Vendor Advisory
https://www.altn.com/Support/SecurityUpdate/MD082520_MDaemon_EN/
More from Mdaemon Webmail
8.8
CVE-2018-17792
MDaemon Webmail (formerly WorldClient) has CSRF
5.4
CVE-2020-18724
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS…