PT-2019-13307 · Mindpalette · Mindpalette Natemail

Published 2019-10-15 · Updated 2019-10-18 · CVE-2019-13392

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MindPalette NateMail version 3.0.15

Description A reflected Cross-Site Scripting issue allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application reflects the recipient value if it is not in the NateMail recipient array, which by default is keyed via integers, making any string input invalid.

Recommendations For MindPalette NateMail version 3.0.15, consider validating and sanitizing user input to prevent the reflection of malicious scripts, and ensure the recipient array properly handles string inputs to mitigate the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-13392

Affected Products

Mindpalette Natemail

References · 5

• 🔥 https://doyler.net/security-not-included/natemail-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13392 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13392 · Vendor Advisory
• https://mindpalette.com/tag/natemail · Note
• https://twitter.com/mindpalette · Note