MDaemon Email Server up to 24.5.1b HTML E-Mail Message HTML injection

Summaryinfo

A vulnerability, which was classified as problematic, has been found in MDaemon Email Server up to 24.5.1b. This vulnerability affects unknown code of the component HTML E-Mail Message Handler. The manipulation leads to HTML injection. This vulnerability is referenced as CVE-2024-11182. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in MDaemon Email Server up to 24.5.1b. It has been rated as problematic. This issue affects an unknown functionality of the component HTML E-Mail Message Handler. The manipulation with an unknown input leads to a html injection vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.

The weakness was published by Matthieu Faou. The advisory is shared at files.mdaemon.com. The identification of this vulnerability is CVE-2024-11182 since 11/13/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but an exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 05/19/2025 with a due date of 06/09/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading to version 24.5.1c eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Mail Server Software

Vendor

• MDaemon

Name

• Email Server

Version

• 24.5.1a
• 24.5.1b

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion