Detections
Analytics
Kerio MailServer < 6.6.2 Patch 3 / 6.7.0 Patch 1 XSS (KSEC-2009-06-08-01)
medium Nessus Plugin ID 39354
Language:
Synopsis
The remote webmail server is affected by a cross-site scripting issue.Description
According to its banner, the remote host is running a version of Kerio MailServer prior to 6.6.2 Patch 3 or 6.7.0 Patch 1. The webmail component of such versions is reportedly affected by a cross-site scripting vulnerability on the Integration page.Successful exploitation of this issue could lead to execution of arbitrary HTML and script code in a user's browser within the security context of the affected site.
Solution
Upgrade to Kerio MailServer 6.6.2 Patch 3 / 6.7.0 Patch 1 or later.See Also
Plugin Details
Severity: Medium
ID: 39354
File Name: kerio_kms_670p1_xss.nasl
Version: 1.17
Type: remote
Family: CGI abuses : XSS
Published: 6/11/2009
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:kerio:kerio_mailserver
Required KB Items: kerio/port
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Reference Information
CVE: CVE-2009-2636
BID: 35264