CVE-2024-41959 Cross-site Scripting (XSS) via API Logs in mailcow: dockerized
An unauthenticated attacker can inject JavaScript into API logs, leading to script execution in the victim's browser, potentially causing data theft or unauthorized actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-41959?
CVE-2024-41959 is a high-severity cross-site scripting vulnerability in mailcow-dockerized, published on 5 Aug 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. This payload is executed whenever the API logs page is viewed, potentially allowing an attacker to run malicious scripts in the context of the user's browser. This could lead to unauthorized actions, data theft, or further exploitation of the affected system. This issue has been addressed in the `2024-07` release. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2024-41959?
It affects 1 product.
Products include Mailcow Mailcow\.
How do I fix CVE-2024-41959?
No fix has been published for CVE-2024-41959 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-41959 being exploited?
There is no known exploitation of CVE-2024-41959 in the wild and no public exploit code.
Other vulnerabilities in mailcow-dockerized
- CVE-2025-53909 mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template
- CVE-2024-24760 Mailcow Docker Container Exposure to Local Network
- CVE-2023-34108 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords
- CVE-2022-31138 OS Command Injection in mailcow
- CVE-2022-31245 Command injection in n/a
Sources
Also known as GHSA-v3r3-8f69-ph29.