GFI MailEssentials AI Stored Cross-Site Scripting Vulnerability in Anti-Spam Whitelist Management

A stored cross-site scripting vulnerability has been identified in GFI MailEssentials AI versions prior to 22.4. This issue resides in the Anti-Spam Whitelist management interface, where an authenticated user can inject HTML or JavaScript into a specific parameter. The injected script is stored and later executed in the context of the logged-in user when the management interface is accessed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user accessing the Whitelist management interface.