CyberSec.Space Logo
Back to CVE Browser

CVE-2023-48115

MEDIUM
5.4
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2023-12-21
Last Modified2026-06-17
Data SourcesNVD

Vulnerability Description

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request.

Affected Platforms (CPE)

📦
Smartertools

Smartermail

>= 16.0.8495 and < 16.0.8747

References & Advisories

🔗 https://co3us.gitbook.io/write-ups/stored-dom-xss-in-email-body-of-smartermail
🔗 https://www.smartertools.com/smartermail/release-notes/current
🔗 https://co3us.gitbook.io/write-ups/stored-dom-xss-in-email-body-of-smartermail
🔗 https://www.smartertools.com/smartermail/release-notes/current

Related Vulnerabilities

CVE-2023-481165.4

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment.

CVE-2023-481145.4

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This...

CVE-2021-439776.1

SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.

CVE-2021-322349.8

SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.