PT-2008-4270 · Marshalsec · Mailmarshal Smtp

Published 2008-10-02 · Updated 2017-08-08 · CVE-2008-2831

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MailMarshal SMTP versions 6.0.3.8 through 6.3.0.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the delegated spam management feature of the Spam Quarantine Management (SQM) component. These vulnerabilities allow user-assisted remote authenticated users to inject arbitrary web script or HTML via the list of blocked senders or the list of safe senders.

Recommendations For MailMarshal SMTP versions 6.0.3.8 through 6.3.0.0, consider restricting access to the delegated spam management feature until a fix is available. As a temporary workaround, avoid using the lists of blocked and safe senders in the SQM component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2831

Affected Products

Mailmarshal Smtp

References · 7

• http://marshal.com/kb/article.aspx?id=12175 · Vendor Advisory
• http://secunia.com/advisories/32062 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2831 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45511 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45509 · Note
• http://securityfocus.com/bid/31483 · Note
• http://dcsl.ul.ie/marshal.htm · Note