PT-2004-1095 · Usermin · Usermin

Publicado 2004-06-18 · Atualizado 2017-07-11 · CVE-2004-0588

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Usermin versions prior to 1.070

Description A cross-site scripting (XSS) issue exists in the web mail module, allowing remote attackers to insert arbitrary HTML and script via e-mail messages. Multiple vulnerabilities in the usermin package can lead to breaches of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For versions prior to 1.070, update to a version later than 1.070 to resolve the issue. As a temporary workaround, consider restricting access to the web mail module until a patch is available.

Correção

Identificadores relacionados

BDU:2015-09452

CVE-2004-0588

Produtos afetados

Usermin

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/16494 · Nota
• https://bdu.fstec.ru/vul/2015-09452 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2004-0588 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=108781564518287&w=2 · Nota
• http://gentoo.org/security/en/glsa/glsa-200406-15.xml · Aviso do Fabricante
• http://securityfocus.com/bid/10521 · Correção
• http://lac.co.jp/security/csl/intelligence/SNSadvisory_e/73_e.html · Nota
• http://security.gentoo.org/glsa/glsa-200406-15.xml · Nota