PT-2019-15773 · Afterlogic · Afterlogic Webmail Pro+1

Mariusz Popławski · Publicado 2019-11-26 · Atualizado 2019-12-09 · CVE-2019-19129

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Afterlogic WebMail Pro version 8.3.11 Afterlogic Aurora version 8.3.11

Description The issue allows for Remote Stored XSS via an attachment name.

Recommendations For Afterlogic WebMail Pro version 8.3.11, update to a version that fixes the issue. For Afterlogic Aurora version 8.3.11, update to a version that fixes the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-19129

Produtos afetados

Afterlogic Aurora

Afterlogic Webmail Pro

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-19129 · Nota de Segurança
• https://auroramail.wordpress.com/2019/11/25/vulnerability-closed-in-webmail-and-aurora-remote-stored-xss-in-attachments-name · Nota
• https://osv.dev/vulnerability/CVE-2019-19129 · Aviso do Fabricante
• https://afterlogic.com · Nota