CVE-2024-41960

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload into the Relay Hosts configuration. The injected payload is executed whenever the configuration page is viewed, enabling the attacker to execute arbitrary scripts in the context of the user's browser. This could lead to data theft, or further exploitation. This issue has been addressed in the `2024-07` release. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-419619.6Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in CVE-2024-419626.3Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set w CVE-2024-419648.1Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only CVE-2024-419654.2Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask th CVE-2024-419678.1A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade CVE-2024-419685.4A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.CVE-2024-419698.8A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which CVE-2024-41979.8An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X CVE-2024-419705.7A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.CVE-2024-419718.1A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.CVE-2024-419726.5A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privil CVE-2024-419738.1A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privil