PT-2007-4061 · Vdesk · Vdesk Webmail

R0T · Published 2007-05-17 · Updated 2017-07-29 · CVE-2007-2745

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions vDesk Webmail version 4.03

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the type parameter in the printcal.pl script.

Recommendations For vDesk Webmail version 4.03, consider restricting access to the printcal.pl script until a patch is available, and avoid using the type parameter in this script to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-2745

Affected Products

Vdesk Webmail

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-2745 · Security Note
• http://pridels-team.blogspot.com/2007/05/vdeck-webmail-system-xss-vuln.html · Note
• http://osvdb.org/37922 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34358 · Note
• http://securityfocus.com/bid/24022 · Note