CVE-2024-23187CWE-79

Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option

Medium · published May 6, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please deploy the provided updates and patch releases. CID replacement has been hardened to omit invalid identifiers. No publicly available exploits are known.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00485 · 40.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-05-06T06:36Z
EPSS history
Timeline
  • 06 MAY 06:36Z
    Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option
    cvelistv5