MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Nov 15, 2024 · Catalog

   Detected

   An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.

2. May 19, 2025 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. Jun 9, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.

Affected

• cpe mdaemon/mdaemonversion unspecified
• vendor MDaemon Email Serverversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2024-11182

  MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.

  cisa.gov
• CVE.orgVulnerability recordCVE-2024-11182

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2024-11182

  30-day exploitation probability 31.4%

  first.org
• NIST NVDVulnerability recordCVE-2024-11182

  An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.

  nvd.nist.gov

References

• CISA note · files.mdaemon.com
• CISA note · mdaemon.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov