Vulnerability · Published Nov 29, 2022 · Assigned by twcert
CVE-2022-41676TEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Cross-Site Scripting
Medium 5.4
In plain English
A medium-severity security flaw in MAILD Mail Server from TEAM JOHNLONG SOFTWARE CO., LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.5%top 58.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can send email using the website with malicious JavaScript in the input field, which triggers XSS (Reflected Cross-Site Scripting) attack to the mail recipient.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TEAM JOHNLONG SOFTWARE CO., LTD. | MAILD Mail Server | 4.7 |
Weakness: CWE-85 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N