20 lines
No EOL
979 B
Text
20 lines
No EOL
979 B
Text
Advisory Name: Multiple Reflected Cross-Site Scripting (XSS) in McAfee Email Gateway (formerly
|
||
IronMail)
|
||
Vulnerability Class: Reflected Cross-Site Scripting (XSS)
|
||
Release Date: Tue Apr 6, 2010
|
||
Affected Applications: Secure Mail (Ironmail) ver.6.7.1
|
||
Affected Platforms: FreeBSD 6.2 / Apache-Coyote 1.1
|
||
Local / Remote: Remote
|
||
Severity: Medium – CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
|
||
Researcher: Nahuel Grisolía
|
||
|
||
Vendor Status: Official Patch Released. Install McAfee Email Gateway 6.7.2 Hotfix 2.
|
||
Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf
|
||
|
||
Vulnerability Description:
|
||
Multiple Reflected Cross Site Scripting vulnerabilities were found in Ironmail's Web Access console,
|
||
because the application fails to sanitize user-supplied input. The vulnerabilities can be triggered by any
|
||
logged-in user.
|
||
|
||
Download:
|
||
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/12092.pdf (cybsec_advisory_2010_0402.pdf) |