CVE-2024-45800

🗓️ 16 Sep 2024 19:35:45Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 30 Views🌐 WEB

Snappymail webmail client has an mXSS vulnerability due to the 'cleanHtml()' function allowing invalid HTML elements. However, it is partially mitigated by Content Security Policy. Upgrading to v2.38.0 is recommended

Reporter	Title	Published	Views	Family All 10
FreeBSD	SnappyMail -- multiple mXSS in HTML sanitizer	16 Sep 202400:00	–	freebsd
Circl	CVE-2024-45800	16 Sep 202422:53	–	circl
CNNVD	SnappyMail 跨站脚本漏洞	16 Sep 202400:00	–	cnnvd
Cvelist	CVE-2024-45800 Multiple mXSS found in snappymail HTML parser	16 Sep 202419:35	–	cvelist
EUVD	EUVD-2024-41608	3 Oct 202520:07	–	euvd
Tenable Nessus	FreeBSD : SnappyMail -- multiple mXSS in HTML sanitizer (bd940aba-7467-11ef-a5c4-08002784c58d)	17 Sep 202400:00	–	nessus
NVD	CVE-2024-45800	16 Sep 202420:15	–	nvd
OSV	CVE-2024-45800 Multiple mXSS found in snappymail HTML parser	16 Sep 202419:35	–	osv
RedhatCVE	CVE-2024-45800	23 May 202508:07	–	redhatcve
Vulnrichment	CVE-2024-45800 Multiple mXSS found in snappymail HTML parser	16 Sep 202419:35	–	vulnrichment

Vulners

Node

the-djmaze snappymailRange<2.38.0

[
  {
    "vendor": "the-djmaze",
    "product": "snappymail",
    "versions": [
      {
        "version": "< 2.38.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/the-djmaze/snappymail/security/advisories/GHSA-2rq7-79vp-ffxm
github	www.github.com/the-djmaze/snappymail/blob/master/dev/Common/Html.js
github	www.github.com/the-djmaze/snappymail/commit/cfbc47488a6b2e2ae4be484f501ee1a3485f542e

Parameter	Position	Path	Description	CWE
admin	query param	/?admin#/packages	Administration area reference where a mitigation extension may be installed; described as a potential vector related to the vulnerability (exploitation via malformed HTML and admin UI).	CWE-79

15 Apr 2026 00:35Current

5Medium risk

Vulners AI Score5

CVSS 3.15

EPSS0.0014

SSVC

CWE-79