PT-2022-18223 · Unknown · Inmailx Outlook Plugin

0Xvavaldi · Published 2022-07-26 · Updated 2024-11-01 · CVE-2022-27105

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions InMailX Outlook Plugin versions prior to 3.22.0101

Description The issue allows a local user or network administrator to execute HTML/Javascript in the Outlook of users due to unsanitized InMailX Connection names in the Outlook tab. This enables the execution of malicious scripts, potentially leading to security breaches.

Recommendations For versions prior to 3.22.0101, update to version 3.22.0101 or later to resolve the issue. As a temporary workaround, consider restricting access to the Outlook tab or sanitizing InMailX Connection names manually until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-27105

Affected Products

Inmailx Outlook Plugin

References · 6

• 🔥 https://gist.github.com/TheWorkingDeveloper/9b7afbfe56938294480f7613805d3b7f · Exploit
• https://osv.dev/vulnerability/CVE-2022-27105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27105 · Security Note
• http://inmailx.com/products/inmailx · Vendor Advisory
• https://t.me/cibsecurity/47023 · Telegram Post
• https://gist.github.com/0xVavaldi/9b7afbfe56938294480f7613805d3b7f · Note