PT-2012-4114 · Netwin · Surgemail

Loneferret · Published 2012-09-17 · Updated 2012-09-18 · CVE-2012-2575

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SurgeMail version 6.0a4

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message.

Recommendations For version 6.0a4, consider disabling the handling of IFRAME elements in HTML e-mail messages until a patch is available. Restrict access to the email module to minimize the risk of exploitation. Avoid using the SRC attribute in the IFRAME element in the email body until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-2575

Affected Products

Surgemail

References · 4

• 🔥 http://exploit-db.com/exploits/20363 · Exploit
• 🔥 https://exploit-db.com/exploits/20363 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2575 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2575 · Note