CVE-2023-48974

CVSS 9.6 CRITICALEPSS 3.0%CWE-79

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS 9.6EPSS 3.0%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

28 Dec 2023Public PoC

08 Feb 2024Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 2

githubgithub.com/vinnie1717/CVE-2023-48974★ 0 exploitdbwww.exploit-db.com/exploits/51963unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://www.axigen.com/mail-server/download/https://www.axigen.com/updates/axigen-10.3.3.61