CVE-2023-49101

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

W

ebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewing the usage of SSL certificates.

References

Link	Resource
https://www.axigen.com/kb/show/400	Vendor Advisory
https://www.axigen.com/kb/show/400	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:axigen:axigen_mobile_webmail::::::::
	cpe:2.3:a:axigen:axigen_mobile_webmail::::::::
	cpe:2.3:a:axigen:axigen_mobile_webmail::::::::

History

21 Nov 2024, 08:32

Type	Values Removed	Values Added
References	~~() https://www.axigen.com/kb/show/400 - Vendor Advisory~~	() https://www.axigen.com/kb/show/400 - Vendor Advisory

Information

Published : 2024-02-08 22:15

Updated : 2025-06-17 16:15

NVD link : CVE-2023-49101

Mitre link : CVE-2023-49101

CVE.ORG link : CVE-2023-49101

JSON object : View

Products Affected

axigen_mobile_webmail

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-49101", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-02-08T22:15:08.940", "references": [{"url": "https://www.axigen.com/kb/show/400", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.axigen.com/kb/show/400", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewing the usage of SSL certificates."}, {"lang": "es", "value": "WebAdmin en Axigen 10.3.x anterior a 10.3.3.61, 10.4.x anterior a 10.4.24 y 10.5.x anterior a 10.5.10 permite ataques XSS contra administradores debido al mal manejo de la visualizaci\u00f3n del uso de certificados SSL."}], "lastModified": "2025-06-17T16:15:24.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:axigen:axigen_mobile_webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28DC928C-7974-4B07-B970-DD6B841D2E79", "versionEndExcluding": "10.3.3.61", "versionStartIncluding": "10.3.3.0"}, {"criteria": "cpe:2.3:a:axigen:axigen_mobile_webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95DDC008-B95F-4D5F-8E11-979BB0A5796B", "versionEndExcluding": "10.4.24", "versionStartIncluding": "10.4.0"}, {"criteria": "cpe:2.3:a:axigen:axigen_mobile_webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94798C71-063F-4867-98E7-25E318C597AD", "versionEndExcluding": "10.5.10", "versionStartIncluding": "10.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}