CVE-2023-28705: Openfind Mail2000 - XSS (Reflected Cross-site scripting)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-02 · updated 2026-06-17
Weakness: CWE-79

Description

Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it triggers an XSS (Reflected Cross-site scripting) attack.

Affected products

Openfind Mail2000 V8.0: before 8.0 — fixed in 8.0

How to fix

Upgrade to a fixed version: Openfind Mail2000 V8.0 8.0. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/tw/cp-132-7158-751a6-1.html
https://www.twcert.org.tw/tw/cp-132-7158-751a6-1.html

Get alerted when CVE-2023-28705 or the next vulnerability affects your stack