GFI MailEssentials AI Stored Cross-Site Scripting Vulnerability in POP2Exchange Configuration Endpoint

A stored cross-site scripting vulnerability has been identified in GFI MailEssentials AI versions prior to 22.4. The issue resides in the POP2Exchange configuration endpoint, where an authenticated user can inject HTML or JavaScript into the POP3 server login field within the JSON 'popServers' payload. This payload is sent to the 'POP2Exchange.aspx/Save' endpoint, where the injected script is stored and later executed in the management interface, impacting the logged-in user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user accessing the management interface.