PT-2025-6450 · Unknown · Acmailer Cgi

Yuji Tounai · Published 2025-02-12 · Updated 2025-02-12 · CVE-2023-49780

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions acmailer CGI versions 4.0.5 and earlier

Description A cross-site scripting issue exists, allowing an arbitrary script to be executed on the web browser of the user who accessed the management page of the affected product. This can occur when the user accesses the management page, potentially leading to unauthorized actions.

Recommendations For versions 4.0.5 and earlier, consider disabling access to the management page until a fix is available. Restrict access to the affected CGI module to minimize the risk of exploitation. Avoid using the management page in the affected product until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-49780

Affected Products

Acmailer Cgi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-49780 · Security Note
• https://twitter.com/CVEnew/status/1889673503722426753 · Twitter Post
• https://jvn.jp/en/jp/JVN84319378 · Note
• https://t.me/cvenotify/111007 · Telegram Post
• https://acmailer.jp/info/de.cgi?id=113 · Note
• https://t.me/cvedetector/17828 · Telegram Post