The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6550-1 advisory.

    It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing     user input when generating templates. An attacker could, through PHP injection, possibly use this issue to     execute arbitrary code. (CVE-2022-29221)

    It was discovered that Moment.js, that is integrated in the PostfixAdmin code, was using an inefficient     parsing algorithm when processing date strings in the RFC 2822 standard. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-31129)

    It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly escaping     JavaScript code. An attacker could possibly use this issue to conduct cross-site scripting attacks (XSS).
    (CVE-2023-28447)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : PostfixAdmin vulnerabilities (USN-6550-1)

high Nessus Plugin ID 186757

Version 1.1

Version 1.0

Version 1.1 Aug 28, 2024, 7:43 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408281943
Version 1.0 Dec 12, 2023, 5:15 PM New Plugin Feed: 202312121715