CVE-2004-2548 Multiple cross-site scripting (XSS) vulnerabilities in NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to inject arbitrary web script or HTML via (a) a URI containing the scrip...
MediumCVSS 4.3
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to inject arbitrary web script or HTML via (a) a URI containing the script, or (b) the username field in the login form. NOTE: it is possible that the first attack vector is resultant from the error message issue (CVE-2004-2547).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netwin surgemail | <= 2.0a2 | No fix listed |
| netwin surgemail | = 1.8a | No fix listed |
| netwin surgemail | = 1.8b3 | No fix listed |
| netwin surgemail | = 1.8d | No fix listed |
| netwin surgemail | = 1.8f | No fix listed |
| netwin surgemail | = 1.8g3 | No fix listed |
| netwin surgemail | = 1.9 | No fix listed |
| netwin surgemail | = 1.9b2 | No fix listed |
| netwin webmail | = 3.1d | No fix listed |
References
- 20040603 Surgemail - Multiple Vulnerabilities exploit mailing-list patch
- 11772 patch third-party-advisory vendor-advisory
- www.exploitlabs.com exploit
- www.netwinsite.com
- 6746 exploit vdb-entry
- 10483 exploit patch vdb-entry
- surgemail-username-xss(16320) vdb-entry