PT-2017-7538 · Proxmox · Proxmox Mail Gateway

Published 2017-05-03 · Updated 2017-05-12 · CVE-2015-9057

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Proxmox Mail Gateway versions prior to 4.0-8-097d26a9

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via multiple parameters. The affected API endpoints include "/users/index.htm", "/quarantine/spam/manage.htm", "/quarantine/spam/whitelist.htm", "/queues/mail/index/", "/system/ssh.htm", "/queues/mail/?domain=", and "/quarantine/virus/manage.htm".

Recommendations For Proxmox Mail Gateway versions prior to 4.0-8-097d26a9, update to version 4.0-8-097d26a9 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints until a patch is applied. Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-9057

Affected Products

Proxmox Mail Gateway

References · 3

• 🔥 https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-024/?fid=7431 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9057 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9057 · Note