CVE-2001-0857 Cross-site scripting vulnerability in status.php3 in Imp Webmail 2.2.6 and earlier allows remote attackers to gain access to the e-mail of other users by hijacking session cookies via the message para...
HighCVSS 7.5
EPSS 7.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting vulnerability in status.php3 in Imp Webmail 2.2.6 and earlier allows remote attackers to gain access to the e-mail of other users by hijacking session cookies via the message parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| imp webmail | <= 2.2.6 | No fix listed |
References
- CLA-2001:437 vendor-advisory
- 20011109 Imp Webmail session hijacking vulnerability mailing-list
- 20011110 IMP 2.2.7 (SECURITY) released mailing-list
- CSSA-2001-039.0 vendor-advisory
- 668 vdb-entry
- 3525 vdb-entry
- imp-css-steal-cookies(7496) vdb-entry