CVE-2023-48974 is a critical (CVSS 9.6) cross-site scripting flaw in Axigen Mail Server, fixed in release 10.3.3.61 from 22 November 2023. The record places it in WebMail, while the vendor lists it under WebAdmin. Update to 10.3.3.61 or later and review who holds administrator rights.
What's affected
- Axigen Mail Server before 10.3.3.61, per the NVD record.
- The vendor's 10.3.3.61 release notes, dated 22 November 2023, list the fix as AXI-5219 under WebAdmin, with the wording that it allowed JavaScript injection and execution for admin users with specific permissions.
- Source conflict: the record says WebMail and the serverName_input parameter, and scores it as needing no privileges with user interaction. The vendor notes place it in the WebAdmin interface and mention admin users with specific permissions. Check your exposure on both interfaces.
- The vendor page marks 10.3.3.61 as no longer current and names 10.3.3.71 as the latest in that line at the time we read it.
- Severity: the record gives CVSS 9.6, which is critical. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and a user action such as opening a file or clicking a link. Impact on confidentiality is high, on integrity high and on availability high. The scope is changed, meaning the impact can reach beyond the vulnerable component.
How to check if you're exposed
Read your Axigen version from the WebAdmin interface or from the server's version output, and compare it with 10.3.3.61.
Then list who has administrator access and which permissions each admin holds. The vendor wording ties the issue to admin users with specific permissions, so a short admin list reduces the risk. Check whether WebAdmin and WebMail are exposed to the internet or only to internal networks.
If you manage Axigen for customers, run the same check on each instance.
What to do now
- Upgrade Axigen to 10.3.3.61 at minimum, and preferably the newest release in your series.
- Review the administrator list and remove or downgrade accounts that do not need elevated permissions.
- Limit WebAdmin to a management network or VPN.
- Ask admins not to follow links or open pages from untrusted sources while logged in to WebAdmin, until you have patched.
- Read the same release notes for the other security fixes in the build and confirm you are covered.
Why it matters
The class is CWE-79 (Cross-site Scripting). Cross-site scripting happens when an application includes untrusted text in a page without making it safe, so the browser runs it as script. In an admin interface the script runs with the administrator's session, which is why the changed scope and high impact appear in the vector.
A mail server administrator can read and manage mailboxes and settings. Script running in that session can act with the same rights, which makes this much more serious than the same flaw on a public blog. The release notes show several related fixes in the same build, so apply the whole update, not a single patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the issue in WebMail or WebAdmin?
The record names WebMail, the vendor notes list it under WebAdmin. Both interfaces are fixed in the same release, so the upgrade answers either reading.
Does a victim need to click something?
The record's vector requires user interaction, so yes, a user action is part of the attack.
Sources
Last reviewed: 19 October 2026.
