CVE-2025-61084
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-20
Validación incorrecta de entrada
Fecha de publicación:
05/11/2025
Última modificación:
13/11/2025
Descripción
*** Pendiente de traducción *** MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets () in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing even when anti-spoofing protections are in place. NOTE: this is disputed by the Supplier because UI spoofing occurs in a client, not in a server such as MDaemon's product or any other server implementation. Also, if a client without its own spoofing protection must be used, the Header Screening feature in MDaemon's product can be employed to mitigate the client-side vulnerability.
Impacto
Puntuación base 3.x
7.10
Gravedad 3.x
ALTA