CyberRota Analysis
AI-GeneratedA vulnerability exists in Evolution's handling of HTML emails, where a remote attacker can exploit a crafted vCard control to execute arbitrary JavaScript within the mail-viewing context. This flaw circumvents existing security measures, potentially allowing attackers to manipulate user data or perform unauthorized actions. Organizations using Evolution, particularly those that rely on Java for email processing, should prioritize addressing this issue to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.