CVE-2019-12927 - MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks

Back Back to CVE browser

MEDIUM

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks

Published Jul 8, 2019

6.1

MEDIUM

CVSS 3.0

EPSS 0.87%

Description

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

http://www.mailenable.com/Premium-ReleaseNotes.txt
x_refsource_CONFIRMRelease NotesVendor Advisory
https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/
x_refsource_MISCRelease NotesThird Party Advisory

Link	Providers	Tags
http://www.mailenable.com/Premium-ReleaseNotes.txt		x_refsource_CONFIRMRelease NotesVendor Advisory
https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/		x_refsource_MISCRelease NotesThird Party Advisory