PT-2005-1392 · Magic · Magic Winmail Server

Tan Chew Keong · Publicado 2005-01-27 · Atualizado 2017-07-11 · CVE-2005-0314

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Magic Winmail Server version 4.0 Build 1112

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the personal information fields in the user.php file. This could potentially lead to unauthorized actions on the affected system.

Recommendations For Magic Winmail Server version 4.0 Build 1112, consider restricting access to the user.php file until a patch is available, and avoid using the personal information fields in a way that could allow arbitrary script injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-0314

Produtos afetados

Magic Winmail Server

Referências · 7

• http://securityfocus.com/bid/12388 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19113 · Nota
• http://marc.info/?l=bugtraq&m=110685011825461&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0314 · Nota de Segurança
• http://secunia.com/advisories/14053 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0314 · Nota
• http://securitytracker.com/id?1013017 · Nota