Good for Enterprise 2.2.2.1611 - Cross-Site Scripting

🗓️ 25 Sep 2013 00:00:00Reported by MarioType

Good for Enterprise 2.2.2.1611 Cross-Site Scripting vulnerability in HTML Emai

Reporter	Title	Published	Views	Family All 11
0day.today	Good for Enterprise 2.2.2.1611 - XSS Vulnerability	25 Sep 201300:00	–	zdt
CVE	CVE-2013-5118	25 Sep 201310:00	–	cve
Cvelist	CVE-2013-5118	25 Sep 201310:00	–	cvelist
EUVD	EUVD-2013-4959	7 Oct 202500:30	–	euvd
exploitpack	Good for Enterprise 2.2.2.1611 - Cross-Site Scripting	25 Sep 201300:00	–	exploitpack
NVD	CVE-2013-5118	25 Sep 201310:31	–	nvd
Packet Storm	Good For Enterprise 2.2.2.1611 Cross Site Scripting	24 Sep 201300:00	–	packetstorm
Prion	Cross site scripting	25 Sep 201310:31	–	prion
RedhatCVE	CVE-2013-5118	22 May 202506:11	–	redhatcve
securityvulns	CVE-2013-5118 - XSS Good for Enterprise iOS	1 Oct 201300:00	–	securityvulns

The vulnerable versions are v2.2.2.1611 and earlier
 
Proof of Concept:
HTML Email including the following payload will execute Javascript statements when the victim open the email using the vulnerable version.
 
Payload:
<body>
<div>
<script>alert('XSS Here')</script>
</div>
</body>
 
Remediation:
I worked with the Good people to close the issue, I provided some guidance and feedback and agreed with them to not disclose it until they fix it.

The new release is now available:
Update the "Good for Enterprise" iOS application to 2.2.4.1659 or newer
 
References:
https://www.roblest.com/#research:CVE-2013-5118 

Can the comunity please provide feedback and comments in order to ensure the fix is working well

Many thanks

Mario

25 Sep 2013 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 24.3

EPSS0.00406