PT-2019-13970 · Mail2000 · Mail2000

Tony Kuo + 1 · Published 2019-11-20 · Updated 2019-11-22 · CVE-2019-15072

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MAIL2000 versions 6.0 and 7.0

Description The issue is related to a cross-site scripting (XSS) vulnerability in the login feature of the "/cgi-bin/portal" endpoint, allowing the execution of arbitrary code via any parameter. This affects many mail systems of governments, organizations, companies, and universities.

Recommendations For MAIL2000 versions 6.0 and 7.0, as a temporary workaround, consider restricting access to the "/cgi-bin/portal" endpoint until a patch is available. Avoid using any parameters in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-15072

Affected Products

Mail2000

References · 8

• https://osv.dev/vulnerability/CVE-2019-15072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15072 · Security Note
• https://openfind.com.tw/taiwan/resource.html · Vendor Advisory
• https://gist.github.com/tonykuo76/5bf1ac369d953d5276afe0a2d04c2147 · Note
• https://twcert.org.tw/en/cp-128-3086-ff35d-2.html · Note
• https://tvn.twcert.org.tw/taiwanvn/TVN-201909002 · Note
• https://gist.github.com/chtsecurity/b3396500d4686ad47fb26f64967ef24a · Note
• https://chtsecurity.com/download/0837ce00c27c73dd3ba3a0d4a7df3a41aaea1ac1e9831a5d61bb64ed484a3598.txt · Note