Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 10.6.39, 10.7.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Axigen Mail Server's WebMail component is affected. An unauthenticated remote attacker can send an email with malicious script in the sender's display name, which runs in the recipient's browser when they open the folder, potentially letting the attacker steal mailbox content or redirect the user.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Axigen Axigen Mail Server
From 10.5.0 · fixed in 10.6.39; From 10.7.0 · fixed in 10.7.1