PT-2006-6201 · Planet+1 · Iplanet Messaging Server+1

Publicado 2006-10-24 · Atualizado 2017-07-20 · CVE-2006-5486

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sun Java System Messaging Server versions 6.0 through 6.2 iPlanet Messaging Server version 5.2

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to execute arbitrary Javascript via crafted messages. This could potentially lead to unauthorized actions on the web application.

Recommendations For Sun Java System Messaging Server versions 6.0 through 6.2, update to a version that includes a fix for this issue. For iPlanet Messaging Server version 5.2, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting the use of Webmail in these versions to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2006-5486

Produtos afetados

Sun Java System Messaging Server

Iplanet Messaging Server

Referências · 7

• http://secunia.com/advisories/22575 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-5486 · Nota de Segurança
• http://securityfocus.com/bid/20708 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102497-1 · Aviso do Fabricante
• http://securitytracker.com/id?1017113 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29806 · Nota
• http://vupen.com/english/advisories/2006/4183 · Nota