Описание
MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients by (1) splitting the SCRIPT tag into smaller pieces, (2) including the script in a SRC argument to an IMG tag, or (3) using "&={script}" syntax.
Ссылки
- PatchVendor Advisory
- Vendor Advisory
- PatchVendor Advisory
- PatchVendor Advisory
- Vendor Advisory
- PatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:mhonarc:mhonarc:2.5:*:*:*:*:*:*:*
cpe:2.3:a:mhonarc:mhonarc:2.5.1:*:*:*:*:*:*:*
cpe:2.3:a:mhonarc:mhonarc:2.5.2:*:*:*:*:*:*:*
EPSS
Процентиль: 78%
0.01141
Низкий
7.5 High
CVSS2
Дефекты
NVD-CWE-Other
Связанные уязвимости
debian
около 23 лет назад
MHonArc 2.5.2 and earlier does not properly filter Javascript from arc ...
github
больше 3 лет назад
MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients by (1) splitting the SCRIPT tag into smaller pieces, (2) including the script in a SRC argument to an IMG tag, or (3) using "&={script}" syntax.
EPSS
Процентиль: 78%
0.01141
Низкий
7.5 High
CVSS2
Дефекты
NVD-CWE-Other