CVE-2014-2325

Name of the Vulnerable Software and Affected Versions Proxmox Mail Gateway versions prior to 3.1-5829

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the state parameter to the "objects/who/index.htm" endpoint or the User email address to the "quarantine/spam/manage.htm" endpoint.

Recommendations For Proxmox Mail Gateway versions prior to 3.1-5829, update to version 3.1-5829 or later to resolve the issue. As a temporary workaround, consider restricting access to the "objects/who/index.htm" and "quarantine/spam/manage.htm" endpoints until the update is applied. Avoid using the state parameter and unverified User email addresses in these endpoints to minimize the risk of exploitation.