PT-2017-13570 · Afterlogic · Afterlogic Webmail Pro+1

Publicado 2017-09-19 · Atualizado 2017-09-22 · CVE-2017-14597

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AfterLogic WebMail version 7.7 AfterLogic Aurora version 7.7.5

Description The issue concerns an XSS vulnerability in the AdminPanel of AfterLogic WebMail and Aurora. This vulnerability can be exploited via the txtDomainName field in the adminpanel/modules/pro/inc/ajax.php endpoint during the addition of a domain.

Recommendations For AfterLogic WebMail version 7.7, update to a version that includes a fix for this issue. For AfterLogic Aurora version 7.7.5, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the adminpanel/modules/pro/inc/ajax.php endpoint to minimize the risk of exploitation. Avoid using the txtDomainName field in the affected endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-14597

Produtos afetados

Afterlogic Aurora

Afterlogic Webmail Pro

Referências · 3

• 🔥 https://auroramail.wordpress.com/2017/08/28/vulnerability-in-webmailaurora-closed · Exploit
• https://osv.dev/vulnerability/CVE-2017-14597 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14597 · Nota de Segurança