PT-2023-21917 · Openfind · Openfind Mail2000

Published 2023-06-02 · Updated 2025-12-22 · CVE-2023-28705

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Openfind Mail2000 (affected versions not specified)

Description The issue arises from insufficient filtering of special characters in email content by the content filtering function. A remote attacker can exploit this by sending phishing emails containing malicious web pages injected with JavaScript, triggering a Reflected Cross-site scripting (XSS) attack when users access the system and open the email.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28705

Affected Products

Openfind Mail2000

References · 6

• https://osv.dev/vulnerability/CVE-2023-28705 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28705 · Security Note
• https://t.me/cibsecurity/64880 · Telegram Post
• https://t.me/cvenotify/51610 · Telegram Post
• https://twcert.org.tw/tw/cp-132-7158-751a6-1.html · Note
• https://twitter.com/davidsheyi/status/2003089767362183211 · Twitter Post