CVE-2020-27509
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Persistent XSS in Galaxkey Secure Mail Client up to version 5.6.11.5 allows an attacker to intercept an HTTP POST request when sending an email and inject a crafted XSS payload in the 'subject' field, which executes when the recipient logs into their mailbox.
Risk Assessment
Risk of account takeover via XSS execution in the victim's session context, potentially leading to data theft or unauthorized actions.
Recommendation
Immediately update Galaxkey Secure Mail Client to a version later than 5.6.11.5 that includes a fix for the XSS vulnerability.
Original NVD description (English source)
Persistent XSS in Galaxkey Secure Mail Client in Galaxkey up to 5.6.11.5 allows an attacker to perform an account takeover by intercepting the HTTP Post request when sending an email and injecting a specially crafted XSS payload in the 'subject' field. The payload executes when the recipient logs into their mailbox.