CVE-2020-18723

{"id": "CVE-2020-18723", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-02-03T18:15:16.053", "references": [{"url": "http://kailashbohara.com.np/blog/2020/07/15/mdaemon-stored-xss", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/161332/Alt-N-MDaemon-Webmail-20.0.0-Cross-Site-Scripting.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://www.altn.com/Support/SecurityUpdate/MD082520_MDaemon_EN/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities."}, {"lang": "es", "value": "Una vulnerabilidad de tipo cross-site scripting (XSS) almacenado en el campo file attachment en MDaemon webmail versi\u00f3n 19.5.5, permiten a un atacante ejecutar c\u00f3digo en el lado del destinatario del correo electr\u00f3nico mientras reenv\u00eda un correo electr\u00f3nico para llevar a cabo actividades potencialmente maliciosas"}], "lastModified": "2021-02-25T17:17:48.443", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:altn:mdaemon_webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A567613-BD31-495B-BCB5-CF05DD4C3A3F", "versionEndExcluding": "20.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}