MailEnable Reflected Cross-Site Scripting Vulnerability in Address Book Component

A reflected cross-site scripting vulnerability has been identified in MailEnable versions prior to 10.54. The issue resides in the AddressesBcc parameter of the AddressBook.aspx page. The vulnerability arises because the AddressesBcc value is not adequately sanitized when processed through a GET request, allowing attacker-controlled scripts to be injected and executed in the context of the user's browser. This exploitation occurs when the victim attempts to send an email, potentially leading to the theft of non-HttpOnly cookies, execution of actions on behalf of the authenticated user, and redirection to malicious websites.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the victim's browser, with the potential to steal non-HttpOnly cookies, perform actions as the authenticated user, and redirect the victim to malicious sites.

Remediation

Users can update to MailEnable version 10.54 or later to address this vulnerability.