PT-2012-4111 · Ivitek · Winwebmail Server

Loneferret · Published 2012-08-12 · Updated 2026-01-27 · CVE-2012-2571

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WinWebMail Server version 3.8.1.6

Description The issue allows remote attackers to inject arbitrary web script or HTML via an e-mail message body using various methods, including a SCRIPT element, crafted Cascading Style Sheets (CSS) expressions, or specific attributes in HTML elements.

Recommendations For WinWebMail Server version 3.8.1.6, consider disabling the processing of e-mail message bodies containing SCRIPT elements, CSS expressions, or specific attributes until a patch is available. Restrict access to the e-mail functionality to minimize the risk of exploitation. Avoid using the STYLE attribute in arbitrary elements and restrict the use of IFRAME elements with crafted SRC attributes. Additionally, restrict the use of UTF-7 text in HTTP-EQUIV="CONTENT-TYPE" META elements.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-2571

Affected Products

Winwebmail Server

References · 4

• 🔥 http://exploit-db.com/exploits/20366 · Exploit
• 🔥 https://exploit-db.com/exploits/20366 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2571 · Security Note
• https://t.me/cveNotify/149989 · Telegram Post