PT-2014-4625 · Proxmox · Proxmox Mail Gateway
Publicado
2014-03-14
·
Atualizado
2014-03-26
·
CVE-2014-2325
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Proxmox Mail Gateway versions prior to 3.1-5829
Description
The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the
state parameter to the "objects/who/index.htm" endpoint or the User email address to the "quarantine/spam/manage.htm" endpoint.Recommendations
For Proxmox Mail Gateway versions prior to 3.1-5829, update to version 3.1-5829 or later to resolve the issue. As a temporary workaround, consider restricting access to the "objects/who/index.htm" and "quarantine/spam/manage.htm" endpoints until the update is applied. Avoid using the
state parameter and unverified User email addresses in these endpoints to minimize the risk of exploitation.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Proxmox Mail Gateway