PT-2012-4111 · Ivitek · Winwebmail Server

Loneferret · Publicado 2012-08-12 · Atualizado 2026-01-27 · CVE-2012-2571

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WinWebMail Server version 3.8.1.6

Description The issue allows remote attackers to inject arbitrary web script or HTML via an e-mail message body using various methods, including a SCRIPT element, crafted Cascading Style Sheets (CSS) expressions, or specific attributes in HTML elements.

Recommendations For WinWebMail Server version 3.8.1.6, consider disabling the processing of e-mail message bodies containing SCRIPT elements, CSS expressions, or specific attributes until a patch is available. Restrict access to the e-mail functionality to minimize the risk of exploitation. Avoid using the STYLE attribute in arbitrary elements and restrict the use of IFRAME elements with crafted SRC attributes. Additionally, restrict the use of UTF-7 text in HTTP-EQUIV="CONTENT-TYPE" META elements.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-2571

Produtos afetados

Winwebmail Server

Referências · 4

• 🔥 http://exploit-db.com/exploits/20366 · Exploit
• 🔥 https://exploit-db.com/exploits/20366 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2571 · Nota de Segurança
• https://t.me/cveNotify/149989 · Publicação no Telegram