PT-2004-1095 · Usermin · Usermin

Published 2004-06-18 · Updated 2017-07-11 · CVE-2004-0588

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Usermin versions prior to 1.070

Description A cross-site scripting (XSS) issue exists in the web mail module, allowing remote attackers to insert arbitrary HTML and script via e-mail messages. Multiple vulnerabilities in the usermin package can lead to breaches of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For versions prior to 1.070, update to a version later than 1.070 to resolve the issue. As a temporary workaround, consider restricting access to the web mail module until a patch is available.

Fix

Related Identifiers

BDU:2015-09452

CVE-2004-0588

Affected Products

Usermin

References · 8

• https://bdu.fstec.ru/vul/2015-09452 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2004-0588 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200406-15.xml · Vendor Advisory
• http://securityfocus.com/bid/10521 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16494 · Note
• http://marc.info/?l=bugtraq&m=108781564518287&w=2 · Note
• http://lac.co.jp/security/csl/intelligence/SNSadvisory_e/73_e.html · Note
• http://security.gentoo.org/glsa/glsa-200406-15.xml · Note