Description (CNA)
MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Id parameter of /Mobile/ContactDetails.aspx. The Id value is not properly sanitized when processed via a GET request and is reflected within a <script> block in the response. By supplying a crafted payload that terminates an existing JavaScript function, inserts attacker-controlled script, and comments out remaining code, a remote attacker can execute arbitrary JavaScript in a victim’s browser when the victim opens a malicious link. Successful exploitation can redirect victims to malicious sites, steal cookies not protected by HttpOnly, inject arbitrary HTML or CSS, and perform actions as the authenticated user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| MailEnable / MailEnable | affected 0 before 10.54 |
CWE
CWE-79
References
- https://mailenable.com/Standard-ReleaseNotes.txt
- https://www.mailenable.com/
- https://www.vulncheck.com/advisories/mailenable-reflected-xss-in-id-parameter-of-mobile-contactdetails-aspx
ADP enrichment
No English description supplied.
No references supplied.