Detections
Analytics

TIPS MailPost append Parameter XSS

medium Nessus Plugin ID 15626

Language:

Synopsis

A web application running on the remote host has a cross-site scripting vulnerability.

Description

TIPS MailPost, a web application used for emailing HTML form data to a third party, is installed on the remote host.

The version of MailPost hosted on the remote web server has a cross-site scripting vulnerability in the 'append' variable of mailpost.exe when debug mode is enabled. Debug mode is enabled by default. A remote attacker could exploit this to impersonate legitimate users.

This version of MailPost reportedly has other vulnerabilities, though Nessus has not checked for those issues.

Solution

Disable debug mode.

Plugin Details

Severity: Medium

ID: 15626

File Name: mailpost_multiple_flaws.nasl

Version: 1.21

Type: remote

Published: 11/4/2004

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Vulnerability Publication Date: 11/3/2004

Reference Information

CVE: CVE-2004-1101

BID: 11596

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990

CERT: 107998

Secunia: 13093