{"id":"CVE-2024-11182","published":"2024-11-15T11:15:10Z","modified":"2026-06-17T06:57:13Z","title":"MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability","vendor":"MDaemon","product":"Email Server","tier":"core","eol":null,"description":{"text":"An XSS issue was discovered in \n\nMDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message \nwith \nJavaScript in an img tag. This could\n allow a remote attacker\n\nto load arbitrary JavaScript code in the context of a webmail user's browser window.","provenance":"source","from":"NVD"},"summary":{"text":"MDaemon Email Server, prior to version 24.5.1c, contains a cross-site scripting flaw in its webmail interface that stems from improper neutralization of input during web page generation. An attacker who can send an HTML e-mail containing JavaScript inside an img tag, with the victim user interacting with the message in webmail, can execute arbitrary JavaScript in that user's browser session without needing authentication to the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:53Z"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.33259,"percentile":0.98365,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-05-19","dueDate":"2025-06-09","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://files.mdaemon.com/mdaemon/beta/RelNotes_en.html ; https://mdaemon.com/pages/downloads-critical-updates ; https://nvd.nist.gov/vuln/detail/CVE-2024-11182","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-05-15","exploitedFirstSeen":"2025-05-15","ransomware":false,"evidence":[{"url":"https://www.welivesecurity.com/en/eset-research/operation-roundpress/","date":"2025-05-15"},{"url":"https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q4-2024-q1-2025.pdf","date":"2025-05-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-05-19"},{"url":"https://cyble.com/blog/latest-security-vulnerabilities-ivanti/","date":"2025-05-20"},{"url":"https://blog.polyswarm.io/fancy-bears-spypress-malware","date":"2025-05-23"},{"url":"https://ics-cert.kaspersky.com/publications/reports/2025/09/04/apt-and-financial-attacks-on-industrial-organizations-in-q2-2025/","date":"2025-09-04"},{"url":"https://www.picussecurity.com/resource/blog/apt28-cyber-threat-profile-and-detailed-ttps","date":"2025-12-10"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://files.mdaemon.com/mdaemon/beta/RelNotes_en.html","tags":["Release Notes"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11182","tags":["US Government Resource"]}],"techniques":[{"id":"T1566","name":"Phishing","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"exploitation_technique","evidence":[],"comment":"Threat actors can use spearphishing to deliver a malicious JavaScript payload, which then allows exfiltration of sensitive data from the email servers.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"primary_impact","evidence":[],"comment":"Threat actors can use spearphishing to deliver a malicious JavaScript payload, which then allows exfiltration of sensitive data from the email servers.","confidence":"high"},{"id":"T1567","name":"Exfiltration Over Web Service","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"primary_impact","evidence":[],"comment":"Threat actors can use spearphishing to deliver a malicious JavaScript payload, which then allows exfiltration of sensitive data from the email servers.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-33681","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-33681","exploited":true,"exploitedSince":"2025-05-19","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1566"],"provenance":"source"},{"stage":"primary","techniques":["T1059","T1567"],"provenance":"source"}],"timeline":[{"date":"2024-11-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11182","provenance":"source"},{"date":"2025-05-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.welivesecurity.com/en/eset-research/operation-roundpress/","provenance":"source"},{"date":"2025-05-19","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-05-19","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-33681","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":185},"priority":{"score":61.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 533 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.67,"detail":"percentile 0.9837"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.27,"detail":"base score 6.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}