CVEvulnerability
CVE-2023-48115
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-12-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request.
Affected configurations
• smartertools smartermail (>= 16.0.8495 < 16.0.8747)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://co3us.gitbook.io/write-ups/stored-dom-xss-in-email-body-of-smartermail Exploit, Third Party Advisory
- https://www.smartertools.com/smartermail/release-notes/current Release Notes
- https://co3us.gitbook.io/write-ups/stored-dom-xss-in-email-body-of-smartermail Exploit, Third Party Advisory
- https://www.smartertools.com/smartermail/release-notes/current Release Notes