PT-2014-4625 · Proxmox · Proxmox Mail Gateway
Published
2014-03-14
·
Updated
2014-03-26
·
CVE-2014-2325
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Proxmox Mail Gateway versions prior to 3.1-5829
Description
The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the
state parameter to the "objects/who/index.htm" endpoint or the User email address to the "quarantine/spam/manage.htm" endpoint.Recommendations
For Proxmox Mail Gateway versions prior to 3.1-5829, update to version 3.1-5829 or later to resolve the issue. As a temporary workaround, consider restricting access to the "objects/who/index.htm" and "quarantine/spam/manage.htm" endpoints until the update is applied. Avoid using the
state parameter and unverified User email addresses in these endpoints to minimize the risk of exploitation.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Proxmox Mail Gateway