CVE-2023-5688: Cross-site Scripting (XSS) in modoboa/modoboa
Summary
CVE-2023-5688: Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2. Affects modoboa across 2 version ranges.
< 2.2.2
< d33d3cd2d11dbfebd8162c46e2c2a9873919a967
Fixed in d33d3cd2d11dbfebd8162c46e2c2a9873919a967. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
modoboa is a Python package available on PyPI that provides a mail hosting and management platform. It allows users to create and manage mailboxes, aliases, and domains. The package is widely used for managing email services in various organizations. However, versions prior to 2.2.2 are vulnerable to a Cross-site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability in modoboa/modoboa prior to version 2.2.2 is a Cross-site Scripting (XSS) issue. This type of vulnerability allows an attacker to inject malicious scripts into web pages viewed by users. In the case of modoboa, the XSS vulnerability occurs in the DOM (Document Object Model) of GitHub repositories. An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the context of a victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.
How To Fix
Latest published version: 2.11.1 as of 23 Oct 2026
pip install --upgrade "modoboa==2.11.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
d33d3cd2d11dbfebd8162c46e2c2a9873919a967
This is the first release that contains the fix.
pip install --upgrade "modoboa==d33d3cd2d11dbfebd8162c46e2c2a9873919a967"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of exploitation.
Conclusion
In conclusion, the modoboa/modoboa package prior to version 2.2.2 is vulnerable to a Cross-site Scripting (XSS) attack. Users are advised to upgrade to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for modoboa →
FAQ
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. These scripts can be used to steal sensitive information, hijack user sessions, or perform other malicious actions.
The XSS vulnerability in modoboa/modoboa allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various attacks, such as session hijacking, data theft, or the manipulation of user interface elements.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is crucial to upgrade to the fixed version to prevent potential exploitation.
Yes, all versions of modoboa/modoboa prior to version 2.2.2 are affected by this vulnerability. It is recommended to upgrade to the fixed version to mitigate the risk.
More information about this vulnerability can be found in the modoboa advisory database at the following source: https://github.com/pypa/advisory-database/blob/main/vulns/modoboa/PYSEC-2023-215.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for modoboa.
