PT-2006-4128 · Owm · Open Webmail

Jose Alves · Published 2006-06-27 · Updated 2017-07-20 · CVE-2006-3233

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open WebMail (OWM) versions prior to 2.52

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the from field. This enables attackers to execute malicious scripts on the victim's browser.

Recommendations For Open WebMail (OWM) versions prior to 2.52, update to a version released after 06/18/2006 to resolve the issue. As a temporary workaround, consider restricting input to the from field to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-3233

Affected Products

Open Webmail

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-3233 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27309 · Note
• http://attrition.org/pipermail/vim/2006-June/000902.html · Note
• http://securityfocus.com/bid/18598 · Note
• http://vupen.com/english/advisories/2006/2485 · Note
• http://secunia.com/advisories/20714 · Note
• http://openwebmail.org/openwebmail/doc/changes.txt · Note
• http://openwebmail.acatysmoof.com/dev/svn/index.pl/openwebmail/diff/trunk/src/cgi-bin/openwebmail/openwebmail-read.pl?rev1=236%3Brev2=237 · Note