Lucene search

[email protected]CVE-2004-2548

HistoryNov 21, 2005 - 11:00 a.m.

CVE-2004-2548

2005-11-2111:00:00

[email protected]

web.nvd.nist.gov

cve-2004-2548

cross-site scripting

xss

netwin

surgemail

webmail

remote attackers

html injection

6 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.011 Low

EPSS

Percentile

84.1%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to inject arbitrary web script or HTML via (a) a URI containing the script, or (b) the username field in the login form. NOTE: it is possible that the first attack vector is resultant from the error message issue (CVE-2004-2547).

Affected configurations

NVD

Node

netwinsurgemailRange≤2.0a2

netwinsurgemailMatch1.8a

netwinsurgemailMatch1.8b3

netwinsurgemailMatch1.8d

netwinsurgemailMatch1.8f

netwinsurgemailMatch1.8g3

netwinsurgemailMatch1.9

netwinsurgemailMatch1.9b2

netwinwebmailMatch3.1d

CPENameOperatorVersion
netwin:surgemailnetwin surgemaille2.0a2
netwin:surgemailnetwin surgemaileq1.8a
netwin:surgemailnetwin surgemaileq1.8b3
netwin:surgemailnetwin surgemaileq1.8d
netwin:surgemailnetwin surgemaileq1.8f
netwin:surgemailnetwin surgemaileq1.8g3
netwin:surgemailnetwin surgemaileq1.9
netwin:surgemailnetwin surgemaileq1.9b2
netwin:webmailnetwin webmaileq3.1d

CPE	Name	Operator	Version
netwin:surgemail	netwin surgemail	le	2.0a2
netwin:surgemail	netwin surgemail	eq	1.8a
netwin:surgemail	netwin surgemail	eq	1.8b3
netwin:surgemail	netwin surgemail	eq	1.8d
netwin:surgemail	netwin surgemail	eq	1.8f
netwin:surgemail	netwin surgemail	eq	1.8g3
netwin:surgemail	netwin surgemail	eq	1.9
netwin:surgemail	netwin surgemail	eq	1.9b2
netwin:webmail	netwin webmail	eq	3.1d

References

archives.neohapsis.com/archives/fulldisclosure/2004-06/0056.html

secunia.com/advisories/11772

www.exploitlabs.com/files/advisories/EXPL-A-2004-002-surgmail.txt

www.netwinsite.com/surgemail/help/updates.htm

www.osvdb.org/6746

www.securityfocus.com/bid/10483

exchange.xforce.ibmcloud.com/vulnerabilities/16320

6 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.011 Low

EPSS

Percentile

84.1%

JSON

Related for CVE-2004-2548

cvelist2 nvd2 cve1