CVE-2018-18621 - CommuniGate Pro 6.2 allows stored XSS via a message body in Pronto! Mail Composer, which is mishandled in /MIME/INBOX-MM-1/ if the raw email link (in .txt format) is modified and then renamed with a .html or .wssp extension

Back Back to CVE browser

MEDIUM

CommuniGate Pro 6.2 allows stored XSS via a message body in Pronto! Mail Composer, which is mishandled in /MIME/INBOX-MM-1/ if the raw email link (in .txt format) is modified and then renamed with a .html or .wssp extension

Published Oct 24, 2018

6.1

MEDIUM

CVSS 3.0

EPSS 1.06%

Description

CommuniGate Pro 6.2 allows stored XSS via a message body in Pronto! Mail Composer, which is mishandled in /MIME/INBOX-MM-1/ if the raw email link (in .txt format) is modified and then renamed with a .html or .wssp extension.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

http://packetstormsecurity.com/files/149916/CommuniGatePro-Pronto-Webmail-6.2-Cross-Site-Scripting.html
x_refsource_MISCThird Party AdvisoryVDB Entry
https://drive.google.com/drive/folders/1irWaVi-AySHFFMap5pF1_7hk6mTeemDT
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-10341
Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/149916/CommuniGatePro-Pronto-Webmail-6.2-Cross-Site-Scripting.html		x_refsource_MISCThird Party AdvisoryVDB Entry
https://drive.google.com/drive/folders/1irWaVi-AySHFFMap5pF1_7hk6mTeemDT		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-10341		Advisory