PT-2005-1392 · Magic · Magic Winmail Server

Tan Chew Keong · Published 2005-01-27 · Updated 2017-07-11 · CVE-2005-0314

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Magic Winmail Server version 4.0 Build 1112

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the personal information fields in the user.php file. This could potentially lead to unauthorized actions on the affected system.

Recommendations For Magic Winmail Server version 4.0 Build 1112, consider restricting access to the user.php file until a patch is available, and avoid using the personal information fields in a way that could allow arbitrary script injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-0314

Affected Products

Magic Winmail Server

References · 7

• http://securityfocus.com/bid/12388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0314 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19113 · Note
• http://marc.info/?l=bugtraq&m=110685011825461&w=2 · Note
• http://secunia.com/advisories/14053 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0314 · Note
• http://securitytracker.com/id?1013017 · Note