CVE-2025-34398: MailEnable < 10.54 Reflected XSS in AddressesBcc Parameter of AddressBook.aspx
MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the AddressesBcc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The AddressesBcc value is not properly sanitized when processed via a GET request and is reflected within a <script> block in the JavaScript variable var sAddrBcc. By supplying a crafted payload that terminates the existing LoadCurAddresses() function, inserts attacker-controlled script, and comments out remaining code, a remote attacker can execute arbitrary JavaScript in a victim’s browser when the victim attempts to send an email. Successful exploitation can redirect victims to malicious sites, steal non-HttpOnly cookies, and perform actions as the authenticated user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34398?
CVE-2025-34398 has a severity rating of high due to its potential to allow attackers to execute arbitrary scripts in the context of the user's session.
How do I fix CVE-2025-34398?
To mitigate CVE-2025-34398, upgrade MailEnable to version 10.54 or later, which addresses the reflected XSS vulnerability.
What is affected by CVE-2025-34398?
CVE-2025-34398 affects MailEnable versions prior to 10.54, specifically relating to the AddressesBcc parameter in AddressBook.aspx.
What type of vulnerability is CVE-2025-34398?
CVE-2025-34398 is a reflected cross-site scripting (XSS) vulnerability.
How does CVE-2025-34398 exploit users?
CVE-2025-34398 can exploit users by reflecting malicious scripts through crafted GET requests, allowing attackers to execute scripts in trusted user sessions.