PT-2020-17094 · Coremail · Coremail Xt

Published 2020-11-27 · Updated 2020-11-30 · CVE-2020-29133

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Coremail XT version 5.0

Description The issue allows for XSS via an uploaded personal signature. This is demonstrated by a .jpg.html filename in the signImgFile parameter.

Recommendations For Coremail XT version 5.0, consider restricting the upload of files with potentially executable content to minimize the risk of exploitation. As a temporary workaround, avoid using the signImgFile parameter until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-29133

Affected Products

Coremail Xt

References · 4

• https://osv.dev/vulnerability/CVE-2020-29133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29133 · Security Note
• https://t.me/cvenotify/6250 · Telegram Post
• https://github.com/fa1c0n1/fa1c0n-vim/blob/master/temp/core_tmp.md · Note