PT-2023-18765 · Openfind · Openfind Mail2000

Published 2023-03-27 · Updated 2023-03-31 · CVE-2023-22902

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Openfind Mail2000 (affected versions not specified)

Description The issue is related to insufficient filtering for user input in the file uploading function. This allows an authenticated remote attacker with general user privilege to inject JavaScript, conducting a cross-site scripting (XSS) attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-22902

Affected Products

Openfind Mail2000

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-22902 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22902 · Vendor Advisory
• https://twcert.org.tw/tw/cp-132-6953-79236-1.html · Note
• https://t.me/cvenotify/47200 · Telegram Post