CVE-2024-41960: Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized
mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload into the Relay Hosts configuration. The injected payload is executed whenever the configuration page is viewed, enabling the attacker to execute arbitrary scripts in the context of the user's browser. This could lead to data theft, or further exploitation. This issue has been addressed in the 2024-07 release. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41960?
CVE-2024-41960 is considered a high severity vulnerability due to the potential for JavaScript injection by an authenticated admin.
How do I fix CVE-2024-41960?
To fix CVE-2024-41960, update Mailcow: Dockerized to a version released after July 2024 that includes the security patch.
Who is affected by CVE-2024-41960?
CVE-2024-41960 affects users of Mailcow: Dockerized versions prior to 2024-07 who have admin access.
What type of attack does CVE-2024-41960 facilitate?
CVE-2024-41960 facilitates cross-site scripting (XSS) attacks through JavaScript payload injection into Relay Hosts configuration.
Can CVE-2024-41960 be exploited remotely?
CVE-2024-41960 requires authenticated access to the admin interface, making it less likely to be exploited remotely without credentials.