PT-2019-19708 · Ability · Ability Mail Server

Published 2019-03-12 · Updated 2019-03-13 · CVE-2019-9557

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ability Mail Server version 4.2.6

Description The issue allows for Persistent Cross Site Scripting (XSS) via the email body. To exploit this, the victim must open an email containing malicious Javascript inserted into the body as an iframe.

Recommendations For Ability Mail Server version 4.2.6, consider disabling the ability to insert iframes into email bodies as a temporary workaround until a patch is available. Restrict access to emails with potentially malicious content to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-9557

Affected Products

Ability Mail Server

References · 3

• 🔥 https://packetstormsecurity.com/files/151958/Ability-Mail-Server-4.2.6-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-9557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9557 · Security Note