Open WebMail openwebmail.pl logindomain Parameter XSS

medium Nessus Plugin ID 16463

Synopsis

The remote webmail server is affected by a cross-site scripting flaw.

Description

The remote host is running at least one instance of Open WebMail that fails to sufficiently validate user input supplied to the 'logindomain' parameter. This failure enables an attacker to run arbitrary script code in the context of a user's web browser.

Solution

Upgrade to Open WebMail version 2.50 20040212 or later.

See Also

http://openwebmail.org/openwebmail/download/cert/advisories/SA-05:01.txt

Plugin Details

Severity: Medium

ID: 16463

File Name: openwebmail_logindomain_xss.nasl

Version: 1.15

Type: remote

Published: 2/16/2005

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

Exploit Ease: No exploit is required

Vulnerability Publication Date: 2/14/2005

Reference Information

CVE: CVE-2005-0445

BID: 12547

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990