PT-2017-14665 · Stalker · Communigate Pro

Boumediene Kaddour · Published 2017-11-27 · Updated 2017-12-12 · CVE-2017-16962

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CommuniGate Pro versions prior to 6.2.1

Description The issue concerns stored XSS vulnerabilities in the WebMail components of CommuniGate Pro, specifically in Crystal, pronto, and pronto4. These vulnerabilities can be exploited through various means, including:

• the location or details field of a Google Calendar invitation,
• a crafted Outlook.com calendar invitation,
• e-mail granting access to a directory with JavaScript in its name,
• JavaScript in a note name,
• JavaScript in a task name,
• HTML e-mail that is mishandled in the Inbox component.

Recommendations For versions prior to 6.2.1, update to version 6.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebMail components or disabling the handling of HTML e-mail in the Inbox component until a patch is applied. Avoid using JavaScript in directory, note, or task names within the WebMail interface.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-16962

Affected Products

Communigate Pro

References · 4

• 🔥 https://exploit-db.com/exploits/43177 · Exploit
• https://osv.dev/vulnerability/CVE-2017-16962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16962 · Security Note
• https://packetstormsecurity.com/files/145095/communigatepro-xss.txt · Note