PT-2019-7236 · Smartertools · Smartermail

Published 2019-01-16 · Updated 2019-01-24 · CVE-2015-9276

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterMail versions prior to 13.3.5535

Description The issue allows for stored XSS attacks by bypassing anti-XSS mechanisms. An attacker can run JavaScript code when a victim user opens or replies to a malicious email. This could lead to users' passwords being reset without needing the current password, as the password reset page does not require it.

Recommendations For versions prior to 13.3.5535, update to version 13.3.5535 or later to resolve the issue. As a temporary workaround, consider restricting access to email contents from untrusted sources to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-9276

Affected Products

Smartermail

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-9276 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9276 · Note
• https://smartertools.com/smartermail/release-notes/13 · Note
• https://nccgroup.trust/uk/our-research/smartermail-stored-xss-in-emails · Note
• https://nccgroup.trust/globalassets/our-research/uk/technical-advisories/2015/technical-advisory-smartermail-stored-xss-in-emails-v2.pdf · Note