CVE-2025-34397
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mailenable | mailenable | 10.54 |
| mailenable | mailenable | to 10.54 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a reflected cross-site scripting (XSS) issue in MailEnable versions prior to 10.54. It occurs in the Message parameter of the /Mobile/Compose.aspx page, where the input is not properly sanitized when processed via a GET request. An attacker can craft a malicious payload that injects arbitrary JavaScript into the response, which executes in the victim's browser when they open the crafted URL. This allows the attacker to run scripts as if they were the authenticated user.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to several impacts: redirecting victims to malicious websites, stealing non-HttpOnly cookies, injecting arbitrary HTML or CSS, and performing actions on behalf of the authenticated user. This can result in unauthorized access, data theft, and manipulation of user sessions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /Mobile/Compose.aspx endpoint with crafted GET requests containing payloads in the Message parameter that attempt to inject JavaScript. For example, you can use curl to send a request with a test XSS payload and observe if the response reflects the payload unsanitized in a JavaScript context. Example command: curl -v "http://<target>/Mobile/Compose.aspx?Message=<script>alert('XSS')</script>" and check if the script is reflected in the response. Additionally, web vulnerability scanners that test for reflected XSS vulnerabilities can be used to automate detection. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading MailEnable to version 10.54 or later, where this vulnerability has been fixed. If upgrading is not immediately possible, consider implementing web application firewall (WAF) rules to block or sanitize requests containing suspicious script tags or JavaScript payloads in the Message parameter. Additionally, educate users to avoid clicking on suspicious links and monitor for unusual activity related to the /Mobile/Compose.aspx endpoint. [2, 3]