Detections
Analytics
IlohaMail Email Header XSS
medium Nessus Plugin ID 14634
Language:
Synopsis
The remote web server contains a PHP script that is affected by a cross-site scripting vulnerability.Description
The remote host is running at least one instance of IlohaMail version 0.8.12 or earlier. Such versions do not properly sanitize message headers, leaving users vulnerable to XSS attacks. For example, a remote attacker could inject JavaScript code that steals the user's session cookie and thereby gain access to that user's account.Solution
Upgrade to IlohaMail version 0.8.13 or later.Plugin Details
Severity: Medium
ID: 14634
File Name: ilohamail_email_header_html_injection.nasl
Version: 1.21
Type: remote
Family: CGI abuses : XSS
Published: 9/2/2004
Updated: 1/19/2021
Supported Sensors: Nessus
Vulnerability Information
Exploit Available: true
Exploit Ease: No exploit is required
Reference Information
BID: 10668