Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting
CVE-2019-15072

6.1MEDIUM

Key Information:

Vendor

Openfind

Status
Mail2000
Vendor
CVE Published:
20 November 2019

What is CVE-2019-15072?

The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.

Affected Version(s)

MAIL2000 6.0

MAIL2000 7.0

References

https://www.openfind.com.tw/taiwan/resource.html
x_refsource_CONFIRM
https://gist.github.com/chtsecurity/b3396500d4686ad47fb26...
x_refsource_CONFIRM
https://gist.github.com/tonykuo76/5bf1ac369d953d5276afe0a...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tony Kuo (CHT Security), Vtim (CHT Security)
.