Detections
Analytics
Alt-N WebAdmin Multiple Remote Vulnerabilities (XSS, Bypass Access)
medium Nessus Plugin ID 16271
Language:
Synopsis
The remote web server is affected by multiple vulnerabilities.Description
The remote host is running Alt-N WebAdmin, a web interface to MDaemon mail server. The remote version of this software is affected by cross-site scripting vulnerabilities due to a lack of filtering on user-supplied input in the file 'useredit_account.wdm' and the file 'modalframe.wdm'. An attacker may exploit this flaw to steal user credentials.This software is also vulnerable to a bypass access attack in the file 'useredit_account.wdm'. An attacker may exploit this flaw to modify user account information.
An attacker needs a valid email account on the server to successfully exploit either of these issues.
Solution
Upgrade to WebAdmin 3.0.3 or later.See Also
Plugin Details
Severity: Medium
ID: 16271
File Name: altn_webadmin_multiple.nasl
Version: 1.26
Type: remote
Family: CGI abuses
Published: 1/28/2005
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.4
CVSS v2
Risk Factor: Medium
Base Score: 6
Temporal Score: 4.4
Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:alt-n:webadmin
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 1/28/2005
Reference Information
CVE: CVE-2005-0317, CVE-2005-0318, CVE-2005-0319
BID: 12395