CVE-2019-15071CWE-79

Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting

published November 20, 2019

CVSS
—
EPSS
2%
Percentile
76.0
In the wild
Unconfirmed
What it is

The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01628 · 76.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2019-11-20T04:06Z
EPSS history
Timeline
  • 20 NOV 04:06Z
    Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting
    cvelistv5