CVE-2015-2702

2015-03-2514:59:07

CWE-79

[email protected]

web.nvd.nist.gov

cve

xss

email security gateway

websense triton ap-email

v-series

remote attack

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.4%

JSON

Cross-site scripting (XSS) vulnerability in the Message Log in the Email Security Gateway in Websense TRITON AP-EMAIL before 8.0.0 and V-Series 7.7 appliances allows remote attackers to inject arbitrary web script or HTML via the sender address in an email.

Affected configurations

NVD

Node

websensetriton_ap_dataRange≤7.8.3

websensetriton_ap_emailRange≤7.8.3

websensetriton_ap_webRange≤7.8.3

websensev-series_appliancesMatch7.7

CPENameOperatorVersion
websense:triton_ap_datawebsense triton ap datale7.8.3
websense:triton_ap_emailwebsense triton ap emaille7.8.3
websense:triton_ap_webwebsense triton ap weble7.8.3
websense:v-series_applianceswebsense v-series applianceseq7.7

CPE	Name	Operator	Version
websense:triton_ap_data	websense triton ap data	le	7.8.3
websense:triton_ap_email	websense triton ap email	le	7.8.3
websense:triton_ap_web	websense triton ap web	le	7.8.3
websense:v-series_appliances	websense v-series appliances	eq	7.7