PT-2002-2621 · Icewarp · Icewarp Web Mail

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-1899

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IceWarp Web Mail versions 3.3.3 through 3.4.5

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the addressname parameter, also known as "Full Name".

Recommendations For IceWarp Web Mail version 3.3.3, update to a version that fixes this issue. For IceWarp Web Mail version 3.4.5, update to a version that fixes this issue. As a temporary workaround, consider restricting the use of the addressname parameter until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2002-1899

Produtos afetados

Icewarp Web Mail

Referências · 5

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-08/0135.html · Exploit
• http://iss.net/security_center/static/9866.php · Nota
• http://archives.neohapsis.com/archives/bugtraq/2002-11/0172.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1899 · Nota de Segurança
• http://icewarp.com/Products/IceWarp_Web_Mail/releasenotes.txt · Nota