PT-2019-7236 · Smartertools · Smartermail

Publicado 2019-01-16 · Atualizado 2019-01-24 · CVE-2015-9276

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterMail versions prior to 13.3.5535

Description The issue allows for stored XSS attacks by bypassing anti-XSS mechanisms. An attacker can run JavaScript code when a victim user opens or replies to a malicious email. This could lead to users' passwords being reset without needing the current password, as the password reset page does not require it.

Recommendations For versions prior to 13.3.5535, update to version 13.3.5535 or later to resolve the issue. As a temporary workaround, consider restricting access to email contents from untrusted sources to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-9276

Produtos afetados

Smartermail

Referências · 5

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9276 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-9276 · Nota de Segurança
• https://smartertools.com/smartermail/release-notes/13 · Nota
• https://nccgroup.trust/uk/our-research/smartermail-stored-xss-in-emails · Nota
• https://nccgroup.trust/globalassets/our-research/uk/technical-advisories/2015/technical-advisory-smartermail-stored-xss-in-emails-v2.pdf · Nota