PT-2019-13027 · Mailenable · Mailenable Enterprise Premium

Publicado 2019-07-08 · Atualizado 2019-07-23 · CVE-2019-12927

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MailEnable Enterprise Premium version 10.23

Description The issue allows for stored and reflected cross-site scripting (XSS) attacks. It is also possible to hijack the session cookie due to the lack of the HttpOnly flag, which can be exploited to gain unauthorized access.

Recommendations For MailEnable Enterprise Premium version 10.23, consider setting the HttpOnly flag for the session cookie to prevent hijacking. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-12927

Produtos afetados

Mailenable Enterprise Premium

Referências · 5

• http://mailenable.com/Premium-ReleaseNotes.txt · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12927 · Nota de Segurança
• https://nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable · Nota
• https://t.me/cvenotify/324 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-12927 · Aviso do Fabricante