CVE-2019-13392 - A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request

Back Back to CVE browser

MEDIUM

A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request

Published Oct 15, 2019

6.1

MEDIUM

CVSS 3.1

EPSS 4.02%

Description

A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4886
Advisory
https://mindpalette.com/tag/natemail/
x_refsource_MISCProduct
https://twitter.com/mindpalette
x_refsource_MISCNot Applicable
https://www.doyler.net/security-not-included/natemail-vulnerabilities
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4886		Advisory
https://mindpalette.com/tag/natemail/		x_refsource_MISCProduct
https://twitter.com/mindpalette		x_refsource_MISCNot Applicable
https://www.doyler.net/security-not-included/natemail-vulnerabilities		x_refsource_MISCExploitThird Party Advisory