PT-2006-4128 · Owm · Open Webmail

Jose Alves · Publicado 2006-06-27 · Atualizado 2017-07-20 · CVE-2006-3233

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open WebMail (OWM) versions prior to 2.52

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the from field. This enables attackers to execute malicious scripts on the victim's browser.

Recommendations For Open WebMail (OWM) versions prior to 2.52, update to a version released after 06/18/2006 to resolve the issue. As a temporary workaround, consider restricting input to the from field to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-3233

Produtos afetados

Open Webmail

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/27309 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3233 · Nota de Segurança
• http://attrition.org/pipermail/vim/2006-June/000902.html · Nota
• http://securityfocus.com/bid/18598 · Nota
• http://vupen.com/english/advisories/2006/2485 · Nota
• http://secunia.com/advisories/20714 · Nota
• http://openwebmail.org/openwebmail/doc/changes.txt · Nota
• http://openwebmail.acatysmoof.com/dev/svn/index.pl/openwebmail/diff/trunk/src/cgi-bin/openwebmail/openwebmail-read.pl?rev1=236%3Brev2=237 · Nota