CVE-2023-40355
MEDIUM NUCLEIAxigen Mobile Webmail 10.3.3.0-10.3.3.58, 10.4.0-10.4.18, 10.5.0-10.5.4 - Authenticated XSS via Version Switch
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-40355. PoCs published by ace-83. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a Python script that checks for the presence of a reflected XSS vulnerability (CVE-2023-40355) in Axigen webmail by sending a crafted request and checking if the payload is reflected in the response. It does not exploit the vulnerability beyond detection.
Description
Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions.
Exploits (1)
The repository contains a Python script that checks for the presence of a reflected XSS vulnerability (CVE-2023-40355) in Axigen webmail by sending a crafted request and checking if the payload is reflected in the response. It does not exploit the vulnerability beyond detection.
Nuclei Templates (1)
http.favicon.hash:-1247684400
icon_hash=-1247684400
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N