CVE-2020-18723

Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

3.80% chance of exploitation in the next 30 days, 89th percentile

Published

2021-02-03

Updated

2024-08-04

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/161332/Alt-N-MDaemon-Webmail-20.0.0-Cross-Site-Scrip…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/49537

References

• CVE Record
• NVD entry

Related

• CVE-2020-18717
• CVE-2020-18724
• CVE-2020-18716
• CVE-2020-18734
• CVE-2020-18714
• CVE-2020-18735