CVE-2025-61084

Katalog CVE

CVSS 7.1 · High EPSS 0,24%

Kerentanan Improper Input Validation. Skor CVSS 3.1 7.1 (High) menurut CISA ADP.

Deskripsi (NVD)

MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing even when anti-spoofing protections are in place. NOTE: this is disputed by the Supplier because UI spoofing occurs in a client, not in a server such as MDaemon's product or any other server implementation. Also, if a client without its own spoofing protection must be used, the Header Screening feature in MDaemon's product can be employed to mitigate the client-side vulnerability.

Rincian

Terbit di NVD

5 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-61084/README.md