{"api_version":"1","generated_at":"2026-07-23T10:28:51+00:00","cve":"CVE-2023-28705","urls":{"html":"https://cve.report/CVE-2023-28705","api":"https://cve.report/api/cve/CVE-2023-28705.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-28705","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-28705"},"summary":{"title":"CVE-2023-28705","description":"Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it triggers an XSS (Reflected Cross-site scripting) attack.","state":"PUBLIC","assigner":"cve@cert.org.tw","published_at":"2023-06-02 11:15:00","updated_at":"2023-06-09 18:14:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7158-751a6-1.html","name":"https://www.twcert.org.tw/tw/cp-132-7158-751a6-1.html","refsource":"MISC","tags":[],"title":"TWCERT/CC台灣電腦網路危機處理暨協調中心|企業資安通報協處|資安情資分享|漏洞通報|資安聯盟|資安電子報-Openfind Mail2000 - XSS (Reflected Cross-site scripting)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28705","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28705","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"28705","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openfind","cpe5":"mail2000","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"AKA":"TWCERT/CC","ASSIGNER":"cve@cert.org.tw","DATE_PUBLIC":"2023-06-09T09:07:00.000Z","ID":"CVE-2023-28705","STATE":"PUBLIC","TITLE":"Openfind Mail2000 - XSS (Reflected Cross-site scripting)"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Mail2000","version":{"version_data":[{"version_affected":"<=","version_value":"7"}]}}]},"vendor_name":"Openfind"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it triggers an XSS (Reflected Cross-site scripting) attack."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://www.twcert.org.tw/tw/cp-132-7158-751a6-1.html","name":"https://www.twcert.org.tw/tw/cp-132-7158-751a6-1.html"}]},"solution":[{"lang":"eng","value":"Update Openfind Mail2000 version to V8"}],"source":{"advisory":"TVN-202306001","discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2023-06-02 11:15:00","lastModifiedDate":"2023-06-09 18:14:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:openfind:mail2000:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}