CVE-2023-40355

Deeper analysis

Axigen WebMail contains a cross-site scripting vulnerability tracked as CVE-2023-40355 that affects versions 10.3.3.0 through 10.3.3.58, 10.4.0 through 10.4.18, and 10.5.0 through 10.5.4. The flaw resides in the logic that switches between the Standard and Ajax interfaces and permits an authenticated user to inject arbitrary script.

An attacker who already possesses valid credentials can exploit the issue by manipulating the version-switching mechanism, resulting in execution of attacker-controlled code within the context of another user's session and potential disclosure of sensitive mailbox or configuration data. The CVSS 5.4 score reflects network attack vector, low attack complexity, and required user interaction, limiting impact to confidentiality and integrity without affecting availability.

Axigen's advisory directs administrators to upgrade to 10.3.3.59, 10.4.19, or 10.5.5, which contain the corrected WebMail logic. The associated EPSS score has reached a peak of 0.1742, indicating moderate but non-negligible exploitation interest since disclosure.