CVE-2024-41959

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. This payload is executed whenever the API logs page is viewed, potentially allowing an attacker to run malicious scripts in the context of the user's browser. This could lead to unauthorized actions, data theft, or further exploitation of the affected system. This issue has been addressed in the `2024-07` release. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
mailcow	mailcow-dockerized	< 2024-07

References

Timeline

Published: Aug 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-41969.8An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specia CVE-2024-419604.8mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload int CVE-2024-419619.6Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in CVE-2024-419626.3Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set w CVE-2024-419648.1Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only CVE-2024-419654.2Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask th CVE-2024-419678.1A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade CVE-2024-419685.4A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.CVE-2024-419698.8A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which CVE-2024-41979.8An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X CVE-2024-419705.7A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.CVE-2024-419718.1A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.