CVE-2019-15071

🗓️ 20 Nov 2019 04:06:20Reported by twcertType

cve🔗 web.nvd.nist.gov👁 84 Views🌐 WEB

The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrar

Reporter	Title	Published	Views	Family All 6
CNVD	Openfind Mail2000 /cgi-bin/go page cross-site scripting vulnerability	20 Nov 201900:00	–	cnvd
Cvelist	CVE-2019-15071 Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting	20 Nov 201904:06	–	cvelist
EUVD	EUVD-2019-6151	7 Oct 202500:30	–	euvd
NVD	CVE-2019-15071	20 Nov 201904:15	–	nvd
OSV	CVE-2019-15071	20 Nov 201904:15	–	osv
Prion	Cross site scripting	20 Nov 201904:15	–	prion

NVD

Node

openfind mail2000Range6.0–7.0

[
  {
    "product": "MAIL2000",
    "vendor": "Openfind",
    "versions": [
      {
        "lessThan": "Before 20190919",
        "status": "affected",
        "version": "6.0",
        "versionType": "custom"
      },
      {
        "lessThan": "SP4 Patch 076",
        "status": "affected",
        "version": "7.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
twcert	www.twcert.org.tw/en/cp-128-3085-45bda-2.html
chtsecurity	www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt
openfind	www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf
openfind	www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf
openfind	www.openfind.com.tw/taiwan/resource.html
gist	www.gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216d
tvn	www.tvn.twcert.org.tw/taiwanvn/TVN-201909001
gist	www.gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27

Parameter	Position	Path	Description	CWE
ACTION	query param	/cgi-bin/go	Cross-site scripting (XSS) via ACTION parameter without authentication in /cgi-bin/go.	CWE-79

21 Nov 2024 04:27Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.3

CVSS 3.16.1

EPSS0.00866

CWE-79