CVE-2019-15071
Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting
- State
- Published
- Severity
- Not scored
- Published
- Nov 20, 2019
- Updated
- Sep 17, 2024
- Reserved
- Aug 15, 2019
Description
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities.
Scores
The record has no CVSS score.
Weaknesses
- CWE-79 Cross-site Scripting (XSS)
Affected Products
| Product | Versions |
|---|---|
MAIL2000Openfind |
|
References
- https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27
- https://www.openfind.com.tw/taiwan/resource.html
- https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216d
- https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt
- https://www.twcert.org.tw/en/cp-128-3085-45bda-2.html
- https://tvn.twcert.org.tw/taiwanvn/TVN-201909001
- https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf
- https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.