PT-2019-13027 · Mailenable · Mailenable Enterprise Premium

Published 2019-07-08 · Updated 2019-07-23 · CVE-2019-12927

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MailEnable Enterprise Premium version 10.23

Description The issue allows for stored and reflected cross-site scripting (XSS) attacks. It is also possible to hijack the session cookie due to the lack of the HttpOnly flag, which can be exploited to gain unauthorized access.

Recommendations For MailEnable Enterprise Premium version 10.23, consider setting the HttpOnly flag for the session cookie to prevent hijacking. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-12927

Affected Products

Mailenable Enterprise Premium

References · 5

• http://mailenable.com/Premium-ReleaseNotes.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12927 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12927 · Vendor Advisory
• https://nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable · Note
• https://t.me/cvenotify/324 · Telegram Post