CVE-2023-48114: XSS
Published Dec 21, 2023
·Updated
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the application tries to allow youtube.com URLs, but actually allows youtube.com followed by an @ character and an attacker-controlled domain name.
Affected Software
1 affected component
SmarterTools SmarterMail>=16.0.8495<16.0.8747
Event History
Dec 21, 2023
CVE Published
12:00 AM
Data Sourced
12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-48114?
CVE-2023-48114 has a potential for high severity due to the exploit being a stored XSS vulnerability.
2
How do I fix CVE-2023-48114?
To mitigate CVE-2023-48114, upgrade SmarterMail to version 16.0.8747 or later.
3
What software is affected by CVE-2023-48114?
CVE-2023-48114 affects SmarterTools SmarterMail versions from 16.0.8495 through 16.0.8664.
4
What type of vulnerability is CVE-2023-48114?
CVE-2023-48114 is a stored cross-site scripting (XSS) vulnerability.
5
How can attackers exploit CVE-2023-48114?
Attackers can exploit CVE-2023-48114 by uploading a malicious SVG document that includes an attacker-controlled domain.