CVE-2004-2334 - Multiple cross-site scripting (XSS) vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to i

CVE-2004-2334

Summary

Multiple cross-site scripting (XSS) vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to inject arbitrary web script or HTML via (1) a hex-encoded value to the variable parameter in emumail.fcgi, (2) the folder parameter in emumail.fcgi, or Javascript in the (3) username or (4) password field in the login page.

References

Vulnerable Configurations

cpe:2.3:a:emumail:emu_webmail:5.2.7:*:*:*:*:*:*:*
cpe:2.3:a:emumail:emu_webmail:5.2.7:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 11-07-2017 - 01:31)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	9861
misc	http://members.lycos.co.uk/r34ct/main/emu/emu.txt http://www.zone-h.com/advisories/read/id=4141
osvdb	4204 4972
sectrack	1009397
secunia	11110
xf	emu-webmail-emumail-xss(15451) emu-webmail-login-xss(15452)

Last major update

11-07-2017 - 01:31

Published

31-12-2004 - 05:00

Last modified

11-07-2017 - 01:31