CVE-2025-61084

{
  "id": "CVE-2025-61084",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-05T15:15:39.997",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Deferred",
  "cveTags": [
    {
      "sourceIdentifier": "[email protected]",
      "tags": [
        "disputed"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing even when anti-spoofing protections are in place. NOTE: this is disputed by the Supplier because UI spoofing occurs in a client, not in a server such as MDaemon's product or any other server implementation. Also, if a client without its own spoofing protection must be used, the Header Screening feature in MDaemon's product can be employed to mitigate the client-side vulnerability."
    },
    {
      "lang": "es",
      "value": "MDaemon Mail Server 23.5.2 valida SPF, DKIM y DMARC utilizando el correo electrónico encerrado entre corchetes angulares (<>) en el encabezado From: de los datos SMTP. Un atacante puede elaborar un encabezado From: con múltiples espacios finos Unicode invisibles para mostrar un remitente falsificado mientras pasa la validación, permitiendo la suplantación de identidad de correo electrónico incluso cuando las protecciones anti-suplantación están implementadas. NOTA: esto es disputado por el Proveedor porque la suplantación de interfaz de usuario (UI) ocurre en un cliente, no en un servidor como el producto de MDaemon o cualquier otra implementación de servidor. Además, si debe usarse un cliente sin su propia protección contra suplantación, la función de Filtrado de Encabezados (Header Screening) en el producto de MDaemon puede emplearse para mitigar la vulnerabilidad del lado del cliente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-05T15:10:10.575326Z",
          "id": "CVE-2025-61084",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-61084/README.md",
      "source": "[email protected]"
    }
  ]
}