Lucene search

[email protected]CVE-2007-5290

HistoryOct 09, 2007 - 6:17 p.m.

CVE-2007-5290

2007-10-0918:17:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2007-5290

cross-site scripting

xss vulnerabilities

mailbee webmail pro

webmail lite asp

webmail lite php

remote attackers

security vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.3%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to login.php and the (2) mode2 parameter to default.asp in an advanced_login mode.

Affected configurations

NVD

Node

afterlogicmailbee_webmaillite_asp

afterlogicmailbee_webmaillite_php

afterlogicmailbee_webmailpro_asp

afterlogicmailbee_webmailMatch3.1pro

afterlogicmailbee_webmailMatch3.2pro

afterlogicmailbee_webmailMatch3.3pro

afterlogicmailbee_webmailMatch3.4pro

CPENameOperatorVersion
afterlogic:mailbee_webmailafterlogic mailbee webmaileq*
afterlogic:mailbee_webmailafterlogic mailbee webmaileq3.1
afterlogic:mailbee_webmailafterlogic mailbee webmaileq3.2
afterlogic:mailbee_webmailafterlogic mailbee webmaileq3.3
afterlogic:mailbee_webmailafterlogic mailbee webmaileq3.4

CPE	Name	Operator	Version
afterlogic:mailbee_webmail	afterlogic mailbee webmail	eq	*
afterlogic:mailbee_webmail	afterlogic mailbee webmail	eq	3.1
afterlogic:mailbee_webmail	afterlogic mailbee webmail	eq	3.2
afterlogic:mailbee_webmail	afterlogic mailbee webmail	eq	3.3
afterlogic:mailbee_webmail	afterlogic mailbee webmail	eq	3.4

References

marc.info/?l=bugtraq&m=119161078031690&w=2

osvdb.org/37649

osvdb.org/37650

secunia.com/advisories/27073

www.securityfocus.com/bid/25942

www.securitytracker.com/id?1018783

www.vupen.com/english/advisories/2007/3450

exchange.xforce.ibmcloud.com/vulnerabilities/36979

Social References

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.3%

JSON

Related for CVE-2007-5290

nvd1 cvelist1 prion1