Summary
@Mail is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary JavaScript code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
@Mail 6.1.9 is vulnerable
prior versions may also be affected.
Solution
Reports indicate that this issue has been fixed by the vendor this
has not been confirmed. Please contact the vendor for more information.
References
Severity
Classification
-
CVE CVE-2010-4930 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities
- Adobe ColdFusion Multiple Full Path Disclosure Vulnerabilities
- Admidio get_file.php Remote File Disclosure Vulnerability
- Apache mod_proxy_ajp Information Disclosure Vulnerability
- Apache Commons Daemon 'jsvc' Information Disclosure Vulnerability
- Apache Struts CookBook/Examples Multiple Cross-Site Scripting Vulnerabilities