CVE-2021-27182: High severity mdaemon vulnerability
An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-27182?
CVE-2021-27182 is an IFRAME injection vulnerability in MDaemon before version 20.0.4, specifically in its Webmail (aka WorldClient) component. It can be exploited via an email message, allowing an attacker to perform actions with the privileges of the targeted user.
How severe is CVE-2021-27182?
CVE-2021-27182 has a severity rating of 8.8 out of 10 (high severity).
How can CVE-2021-27182 be exploited?
CVE-2021-27182 can be exploited by sending a malicious email message that contains an IFRAME injection payload to a user of MDaemon's Webmail (WorldClient) component.
What is the affected software?
The affected software is MDaemon version up to and excluding 20.0.4.
How can I mitigate CVE-2021-27182?
To mitigate CVE-2021-27182, it is recommended to update to MDaemon version 20.0.4 or later as soon as possible.