PT-2019-13307 · Mindpalette · Mindpalette Natemail

Publicado 2019-10-15 · Atualizado 2019-10-18 · CVE-2019-13392

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MindPalette NateMail version 3.0.15

Description A reflected Cross-Site Scripting issue allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application reflects the recipient value if it is not in the NateMail recipient array, which by default is keyed via integers, making any string input invalid.

Recommendations For MindPalette NateMail version 3.0.15, consider validating and sanitizing user input to prevent the reflection of malicious scripts, and ensure the recipient array properly handles string inputs to mitigate the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-13392

Produtos afetados

Mindpalette Natemail

Referências · 5

• 🔥 https://doyler.net/security-not-included/natemail-vulnerabilities · Exploit
• https://mindpalette.com/tag/natemail · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-13392 · Nota de Segurança
• https://twitter.com/mindpalette · Nota
• https://osv.dev/vulnerability/CVE-2019-13392 · Aviso do Fabricante