CVE-2006-6704 - Cross-site scripting (XSS) vulnerability in the Webadmin in @Mail before 4.6 allows remote attackers

CVE-2006-6704

Summary

Cross-site scripting (XSS) vulnerability in the Webadmin in @Mail before 4.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "unescaped data in the database." This vulnerability is addressed in the following product release: @Mail, @Mail Webadmin, 4.6

References

http://terra.calacode.com/mail/docs/changelog.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/31260

Vulnerable Configurations

cpe:2.3:a:atmail:atmail_webadmin:*:*:*:*:*:*:*:*
cpe:2.3:a:atmail:atmail_webadmin:*:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 29-07-2017 - 01:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

confirm	http://terra.calacode.com/mail/docs/changelog.html
xf	@mail-webadmin-xss(31260)

Last major update

29-07-2017 - 01:29

Published

23-12-2006 - 01:28

Last modified

29-07-2017 - 01:29