medium5.4Public exploit code
CVE-2020-18724
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes cod…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Alt-N MDaemon webmail 20.0.0 - 'Contact name' Stored Cross Site Scripting (XSS)2021-02-08 · webapps · windows
Impact
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Altn | Mdaemon Webmail | before 20.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://kailashbohara.com.np/blog/2020/07/15/mdaemon-stored-xss
- http://packetstormsecurity.com/files/161332/Alt-N-MDaemon-Webmail-20.0.0-Cross-Site-Scripting.html
- https://www.altn.com/Support/SecurityUpdate/MD082520_MDaemon_EN/
- http://kailashbohara.com.np/blog/2020/07/15/mdaemon-stored-xss
- http://packetstormsecurity.com/files/161332/Alt-N-MDaemon-Webmail-20.0.0-Cross-Site-Scripting.html
- https://www.altn.com/Support/SecurityUpdate/MD082520_MDaemon_EN/