PT-2012-4114 · Netwin · Surgemail

Loneferret · Publicado 2012-09-17 · Atualizado 2012-09-18 · CVE-2012-2575

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SurgeMail version 6.0a4

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message.

Recommendations For version 6.0a4, consider disabling the handling of IFRAME elements in HTML e-mail messages until a patch is available. Restrict access to the email module to minimize the risk of exploitation. Avoid using the SRC attribute in the IFRAME element in the email body until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-2575

Produtos afetados

Surgemail

Referências · 4

• 🔥 http://exploit-db.com/exploits/20363 · Exploit
• 🔥 https://exploit-db.com/exploits/20363 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2575 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2575 · Nota