Detections
Analytics
Open WebMail Multiple Content Header XSS
medium Nessus Plugin ID 12262
Language:
Synopsis
A remote web application may be vulnerable to cross-site scripting.Description
The target is running at least one instance of Open WebMail whose version is 2.32 or earlier. Such versions are vulnerable to a cross- site scripting attack whereby an attacker can cause a victim to unknowingly run arbitrary JavaScript code by reading a MIME message with a specially crafted Content-Type or Content-Description header. For further information, see :http://www.openwebmail.org/openwebmail/download/cert/advisories/SA-04:05.txt http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-2.txt http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt
***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number of Open WebMail
***** installed there.
Solution
Upgrade to Open WebMail version 2.32 20040603 or later.Plugin Details
Severity: Medium
ID: 12262
File Name: openwebmail_content_type_xss.nasl
Version: 1.24
Type: remote
Family: CGI abuses : XSS
Published: 6/8/2004
Updated: 8/15/2022
Supported Sensors: Nessus
Vulnerability Information
Exploit Available: true
Exploit Ease: No exploit is required
Reference Information
BID: 10667