CVE-2023-48116: SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment

Medium severity · published Dec 21, 2023

CVE-2023-48116

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment

5.4

CVSS

0.4%

EPSS

On KEV

Description

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 29% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Smartermail · Smartertools

16.0.8495 before 16.0.8747 · source: NVD

Affected product

Smartermail

Smartertools

All Smartermail CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-48116

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-48116

Exploit

https://co3us.gitbook.io/write-ups/stored-xss-in-calendar-component-of-smartermail-cve-2023-48116

Release Notes

https://www.smartertools.com/smartermail/release-notes/current