PT-2017-13570 · Afterlogic · Afterlogic Webmail Pro+1

Published 2017-09-19 · Updated 2017-09-22 · CVE-2017-14597

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AfterLogic WebMail version 7.7 AfterLogic Aurora version 7.7.5

Description The issue concerns an XSS vulnerability in the AdminPanel of AfterLogic WebMail and Aurora. This vulnerability can be exploited via the txtDomainName field in the adminpanel/modules/pro/inc/ajax.php endpoint during the addition of a domain.

Recommendations For AfterLogic WebMail version 7.7, update to a version that includes a fix for this issue. For AfterLogic Aurora version 7.7.5, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the adminpanel/modules/pro/inc/ajax.php endpoint to minimize the risk of exploitation. Avoid using the txtDomainName field in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-14597

Affected Products

Afterlogic Aurora

Afterlogic Webmail Pro

References · 3

• 🔥 https://auroramail.wordpress.com/2017/08/28/vulnerability-in-webmailaurora-closed · Exploit
• https://osv.dev/vulnerability/CVE-2017-14597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14597 · Security Note