CVE-2024-11182: MDaemon Email Server XSS via img tag in HTML email

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in CISA KEV with known exploitation and a high EPSS percentile, though CVSS impact is limited to low confidentiality and integrity.

What it is

MDaemon Email Server before version 24.5.1c is vulnerable to cross-site scripting because it fails to neutralize JavaScript embedded in an img tag within an HTML email message. A remote attacker can send a crafted email that executes arbitrary JavaScript in the context of a webmail user's browser window, which matters because webmail sessions often carry authenticated access to mail and settings.

Impact

An attacker can run arbitrary JavaScript in the victim's webmail session, enabling theft of session data or other actions available to that user in the browser. The CVSS 4.0 vector rates confidentiality and integrity impact as low and availability as none.

Attack surface

The flaw is reached over the network by sending an HTML email to a webmail user; the CVSS vector shows no privileges required but user interaction is passive (UI:P), meaning the victim only needs to view the message. No authentication is needed to deliver the malicious email.

Exploitation

CVE-2024-11182 is listed in CISA's Known Exploited Vulnerabilities catalog with a due date of 2025-06-09, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.17705 (97th percentile), and no ransomware campaign use is documented.

What to do

• Upgrade MDaemon Email Server to version 24.5.1c or later.
• If immediate upgrade is not possible, apply the vendor's recommended mitigations or discontinue use of the product per CISA BOD 22-01 guidance.
• Enforce a Content Security Policy on the webmail interface to reduce script execution from email content.
• Sanitize or strip active content such as JavaScript in img tags from inbound HTML email at the gateway.
• Restrict or disable remote image loading in webmail to limit attacker-controlled content rendering.

Detection

• Monitor webmail and email gateway logs for HTML messages containing JavaScript in img tags or other script-bearing attributes.
• Hunt for anomalous outbound requests or script execution originating from webmail sessions shortly after email delivery.
• Review webmail access logs for session anomalies or unexpected actions following receipt of HTML email.
• Alert on MDaemon versions below 24.5.1c still in service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.