What’s Vulnerable › Vulnerabilities

CVE-2023-48115

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-12-21 · updated 2026-06-17
• Weakness: CWE-79

Description

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request.

Affected products

• SmarterTools SmarterMail: from 16.0.8495 before 16.0.8747 — fixed in 16.0.8747

How to fix

Upgrade to a fixed version: SmarterTools SmarterMail 16.0.8747. Check the vendor advisory for mitigations.

References

• https://co3us.gitbook.io/write-ups/stored-dom-xss-in-email-body-of-smartermail
• https://www.smartertools.com/smartermail/release-notes/current
• https://co3us.gitbook.io/write-ups/stored-dom-xss-in-email-body-of-smartermail
• https://www.smartertools.com/smartermail/release-notes/current

Get alerted when CVE-2023-48115 or the next vulnerability affects your stack