PT-2008-4270 · Marshalsec · Mailmarshal Smtp

Publicado 2008-10-02 · Atualizado 2017-08-08 · CVE-2008-2831

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MailMarshal SMTP versions 6.0.3.8 through 6.3.0.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the delegated spam management feature of the Spam Quarantine Management (SQM) component. These vulnerabilities allow user-assisted remote authenticated users to inject arbitrary web script or HTML via the list of blocked senders or the list of safe senders.

Recommendations For MailMarshal SMTP versions 6.0.3.8 through 6.3.0.0, consider restricting access to the delegated spam management feature until a fix is available. As a temporary workaround, avoid using the lists of blocked and safe senders in the SQM component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-2831

Produtos afetados

Mailmarshal Smtp

Referências · 7

• http://marshal.com/kb/article.aspx?id=12175 · Aviso do Fabricante
• http://secunia.com/advisories/32062 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45511 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2831 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45509 · Nota
• http://securityfocus.com/bid/31483 · Nota
• http://dcsl.ul.ie/marshal.htm · Nota