MDaemon Email Server Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability exists in MDaemon Email Server versions 25.0.1 and earlier. This issue allows remote attackers to inject arbitrary JavaScript into an HTML email, which could then be executed in the context of the webmail user's browser, potentially accessing sensitive user data.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the user's browser, potentially leading to the theft of cookies or session tokens, or other sensitive information accessible to the user.

Remediation

Users can update to MDaemon Email Server version 25.0.2 or higher. For those using versions 24.5.x, 24.0.x, 23.5.x, 23.0.x, 22.0.x, 21.5.x, 21.0.x, or 20.x.x, specific update instructions are available on the MDaemon website. Security Gateway for Email users should download the current version from the Security Gateway Downloads page.