modoboa Cross-site Scripting vulnerability (CVE-2023-5689)
Summary
CVE-2023-5689: modoboa Cross-site Scripting vulnerability. Affects modoboa versions < 2.2.2. Fixed in 2.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
modoboa is an open-source email hosting and management platform written in Python. It provides a web-based interface for managing email domains, mailboxes, aliases, and other related features. The platform is widely used by organizations and individuals to set up and manage their email infrastructure. However, a Cross-site Scripting (XSS) vulnerability has been discovered in modoboa versions prior to 2.2.2.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability in modoboa allows an attacker to inject malicious scripts into web pages viewed by users. This can lead to various attacks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user. The vulnerability originates from improper input sanitization, allowing the attacker to bypass security measures and execute arbitrary code in the context of the affected user's browser. The impact of this vulnerability is considered high, with a CVSS score of 7.1.
How To Fix
Latest published version: 2.11.1 as of 23 Oct 2026
pip install --upgrade "modoboa==2.11.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.2
This is the first release that contains the fix.
pip install --upgrade "modoboa==2.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to implement input validation and sanitization on user-generated content. This can help mitigate the risk of XSS attacks by preventing the execution of malicious scripts. It is important to thoroughly review and test any customizations or modifications to ensure they do not introduce new vulnerabilities.
Conclusion
The modoboa Cross-site Scripting vulnerability (CVE-2023-5689) is a high-severity security issue that allows attackers to inject and execute malicious scripts in the context of the affected user's browser. To mitigate the risk, it is recommended to upgrade modoboa to version 2.2.2 or later. Implementing input validation and sanitization on user-generated content can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for modoboa →
FAQ
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. These scripts can be used to steal sensitive information, perform actions on behalf of the user, or hijack user sessions.
The modoboa XSS vulnerability allows attackers to inject and execute malicious scripts in the context of the affected user's browser. This can lead to various attacks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user.
At the time of this advisory, there have been no reported instances of this vulnerability being exploited in the wild. However, it is important to promptly apply the recommended fixes to mitigate the risk.
Yes, a temporary workaround is to implement input validation and sanitization on user-generated content. This can help mitigate the risk of XSS attacks by preventing the execution of malicious scripts. However, it is still recommended to upgrade to the latest version of modoboa as soon as possible.
You can find more information about the modoboa vulnerability, including the technical details and the fix, in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-9wj3-cfq8-wpvj/GHSA-9wj3-cfq8-wpvj.json
Related vulnerabilities
Recent vulnerabilities recorded for modoboa.
