CVE-2012-3536 Apache James Hupa Webmail application Cross-site Scripting Vulnerabilities
MediumCVSS 6.1
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of messages were viewed. This issue was addressed in Hupa 0.0.3.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.james.hupa/hupa-parent(Maven) | < 0.0.3 | 0.0.3 |
| org.apache.james.hupa/hupa-parent(Maven) | = 0.0.2 | No fix listed |
| apache hupa | < 0.0.3 | 0.0.3 |
| Apache Hupa | = Hupa versions prior to 0.0.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- james.apache.org vendor-advisory
- svn.apache.org issue-tracking vendor-advisory
- github.com patch
- github.com