Actively exploited · Published Nov 15, 2024 · Assigned by ESET
CVE-2024-11182Stored XSS vulnerability in MDaemon Email Server
Medium 5.3 Exploited
In plain English
A medium-severity cross-site scripting in Email Server from MDaemon. Attackers are actively exploiting it in the wild (listed by CISA on May 19, 2025). The chance it is exploited in the next 30 days is estimated at 33.3% (higher than 98% of all known vulnerabilities). Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jun 9, 2025.
Official description
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MDaemon | Email Server | 0 – through 24.5.0 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N