CVE-2023-48115

Опубликовано: 21 дек. 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request.

Ссылки

https://co3us.gitbook.io/write-ups/stored-dom-xss-in-email-body-of-smartermail
Exploit
Third Party Advisory
https://www.smartertools.com/smartermail/release-notes/current
Release Notes
https://co3us.gitbook.io/write-ups/stored-dom-xss-in-email-body-of-smartermail
Exploit
Third Party Advisory
https://www.smartertools.com/smartermail/release-notes/current
Release Notes

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*

Версия от 16.0.8495 (включая) до 16.0.8747 (исключая)

EPSS

Процентиль: 38%

0.00169

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-mfr4-4gq8-693m