CVE-2019-15072 Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting

2019-11-1100:00:00

CWE-79

twcert

www.cve.org

0.003 Low

EPSS

Percentile

71.3%

JSON

The login feature in “/cgi-bin/portal” in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.

CNA Affected

[
  {
    "product": "MAIL2000",
    "vendor": "Openfind",
    "versions": [
      {
        "lessThan": "Before 20190919",
        "status": "affected",
        "version": "6.0",
        "versionType": "custom"
      },
      {
        "lessThan": "SP4 Patch 076",
        "status": "affected",
        "version": "7.0",
        "versionType": "custom"
      }
    ]
  }
]