Detections
Analytics
ArGoSoft Mail Server Pro <= 1.8.7.6 Multiple Vulnerabilities (XSS, Traversal, Priv Esc)
medium Nessus Plugin ID 18140
Language:
Synopsis
The remote mail server is affected by multiple flaws.Description
The version of ArGoSoft Mail Server Pro installed on the remote host suffers from several vulnerabilities, including :- Unauthenticated Account Creation Vulnerability The application does not authenticate requests sent through the web interface before creating mail accounts and may create them even if ArGoSoft has been configured not to.
- Multiple Cross-Site Scripting Vulnerabilities ArGoSoft fails to filter some HTML tags in email messages;
eg, the SRC parameter in an IMG tag. An attacker may be able to run arbitrary HTML and script code in a user's browser within the context of the affected website if the user reads email using ArGoSoft's web interface.
Solution
Upgrade to ArGoSoft Mail Server Pro 1.8.7.7 or later.See Also
Plugin Details
Severity: Medium
ID: 18140
File Name: argosoft_1_8_7_6.nasl
Version: 1.24
Type: remote
Family: CGI abuses
Published: 4/26/2005
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.2
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 4/22/2005