PT-2019-19708 · Ability · Ability Mail Server

Publicado 2019-03-12 · Atualizado 2019-03-13 · CVE-2019-9557

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ability Mail Server version 4.2.6

Description The issue allows for Persistent Cross Site Scripting (XSS) via the email body. To exploit this, the victim must open an email containing malicious Javascript inserted into the body as an iframe.

Recommendations For Ability Mail Server version 4.2.6, consider disabling the ability to insert iframes into email bodies as a temporary workaround until a patch is available. Restrict access to emails with potentially malicious content to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-9557

Produtos afetados

Ability Mail Server

Referências · 3

• 🔥 https://packetstormsecurity.com/files/151958/Ability-Mail-Server-4.2.6-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-9557 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9557 · Nota de Segurança