Security readout for executives and security teams
Plain-English summary
Rspamd WebUI before 1.6.3 mishandled email Subject and Message-Id headers on the history page, allowing cross-site scripting. In business terms, a malicious email could potentially affect an administrator viewing message history in the WebUI. Public sources do not provide a CVSS score or evidence of active exploitation.
Executive priority
Treat as a targeted administrative-interface risk, not a confirmed internet-wide emergency. Prioritize remediation where Rspamd WebUI is reachable by administrators and processes untrusted mail history, especially in shared or externally accessible management environments.
Technical view
CVE-2017-11737 is an XSS flaw in interface/js/app/history.js in Rspamd WebUI before 1.6.3. The vulnerable handling involves Subject and Message-Id headers displayed on the history page. The provided record does not include CWE, CVSS vector, affected CPEs, or detailed remediation notes beyond the version boundary.
Likely exposure
Exposure is most likely in environments running Rspamd WebUI versions earlier than 1.6.3 where administrators use the history page to review messages containing untrusted email headers.
Exploitation context
The CVE record and references describe XSS but do not state active exploitation. It is not listed as KEV in the provided bundle. Evidence is insufficient to assess exploit maturity, public proof-of-concept availability, or real-world abuse.
Researcher notes
The public bundle is sparse: it identifies the vulnerable file, WebUI history page, affected headers, and fixed version boundary. It does not provide CVSS, CWE, CPEs, exploit telemetry, or detailed patch mechanics. Avoid over-scoping beyond Rspamd WebUI before 1.6.3.
Mitigation direction
- Identify any Rspamd WebUI instances and confirm their deployed versions.
- Upgrade Rspamd deployments older than 1.6.3 to 1.6.3 or later.
- Review the Rspamd 1.6.3 release notes and issue 1738 for vendor context.
- Restrict WebUI access to trusted administrators while remediation is pending.
- Monitor administrative sessions and WebUI access logs for unusual activity.
Validation and detection
- Check Rspamd package or container version against the 1.6.3 boundary.
- Confirm whether the WebUI history page is enabled and used by administrators.
- Review message history handling for Subject and Message-Id rendering behavior.
- Verify patched deployments no longer run code older than Rspamd 1.6.3.
- Document any exposed WebUI endpoints and access controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-11737 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/vstakhov/rspamd/releases/tag/1.6.3CVE reference · x_refsource_CONFIRM
- https://github.com/vstakhov/rspamd/issues/1738CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.