CVE-2023-49101 - Cross-Site Scripting (XSS) vulnerability

The vulnerability allows an attacker to run arbitrary Javascript code and carry out a cross-site scripting attack against a vulnerable system.

Exploitation of this flaw requires attackers to send a phishing email (or other type of message) to an administrator containing a crafted link. Once the link is opened by the administrator, provided there is an active admin session, attackers can run arbitrary Javascript code that can retrieve the administrator's session cookie. Attackers can then use this cookie to impersonate the administrator in the Axigen mail server software to access its administrative interface.