CVE-2019-15072

🗓️ 20 Nov 2019 04:16:18Reported by twcertType

cve🔗 web.nvd.nist.gov👁 98 Views🌐 WEB

The "/cgi-bin/portal" login feature in MAIL2000 through version 6.0 and 7.0 allows for cross-site scripting (XSS) vulnerability

Reporter	Title	Published	Views	Family All 6
CNVD	Openfind MAIL2000 /cgi-bin/portal Login Function Cross-Site Scripting Vulnerability	20 Nov 201900:00	–	cnvd
Cvelist	CVE-2019-15072 Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting	20 Nov 201904:16	–	cvelist
EUVD	EUVD-2019-6152	7 Oct 202500:30	–	euvd
NVD	CVE-2019-15072	20 Nov 201905:15	–	nvd
OSV	CVE-2019-15072	20 Nov 201905:15	–	osv
Prion	Cross site scripting	20 Nov 201905:15	–	prion

NVD

Node

openfind mail2000Range6.0–7.0

[
  {
    "product": "MAIL2000",
    "vendor": "Openfind",
    "versions": [
      {
        "lessThan": "Before 20190919",
        "status": "affected",
        "version": "6.0",
        "versionType": "custom"
      },
      {
        "lessThan": "SP4 Patch 076",
        "status": "affected",
        "version": "7.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
chtsecurity	www.chtsecurity.com/download/0837ce00c27c73dd3ba3a0d4a7df3a41aaea1ac1e9831a5d61bb64ed484a3598.txt
tvn	www.tvn.twcert.org.tw/taiwanvn/TVN-201909002
gist	www.gist.github.com/tonykuo76/5bf1ac369d953d5276afe0a2d04c2147
openfind	www.openfind.com.tw/taiwan/resource.html
twcert	www.twcert.org.tw/en/cp-128-3086-ff35d-2.html
gist	www.gist.github.com/chtsecurity/b3396500d4686ad47fb26f64967ef24a

Parameter	Position	Path	Description	CWE
any parameter	query param	/cgi-bin/portal	Cross-site scripting (XSS) vulnerability allowing execution of arbitrary code via any parameter in the portal login feature.	CWE-79

21 Nov 2024 04:27Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.3

CVSS 3.16.1

EPSS0.00648

CWE-79