What’s Vulnerable › Vulnerabilities

CVE-2023-49077: mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-30 · updated 2026-06-17
• Weakness: CWE-79

Description

Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the Quarantine feature. An attacker can send a carefully crafted email containing malicious JavaScript code. This issue has been patched in version 2023-11.

Affected products

• mailcow-dockerized: before 2023-11 — fixed in 2023-11

How to fix

Upgrade to a fixed version: mailcow-dockerized 2023-11. Check the vendor advisory for mitigations.

References

• https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-11
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-46x4-w2fm-5x6g
• https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-11
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-46x4-w2fm-5x6g

Get alerted when CVE-2023-49077 or the next vulnerability affects your stack