Apache Pony Mail CVE-2019-0218 Cross Site Scripting Vulnerability

Bugtraq ID:	108046
Class:	Input Validation Error
CVE:	CVE-2019-0218
Remote:	Yes
Local:	No
Published:	Apr 20 2019 12:00AM
Updated:	Apr 20 2019 12:00AM
Credit:	Francesco Soncina - ABN AMRO Red Team.
Vulnerable:	Apache Pony Mail 0.9 Apache Pony Mail 0.8B Apache Pony Mail 0.10
Not Vulnerable:	Apache Pony Mail 0.11

Apache Pony Mail CVE-2019-0218 Cross Site Scripting Vulnerability

Apache Pony Mail is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Apache Pony Mail 0.8 through 0.10 are vulnerable.

Apache Pony Mail CVE-2019-0218 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Pony Mail CVE-2019-0218 Cross Site Scripting Vulnerability

References:

• [ANNOUNCE] Apache Pony Mail (incubating) version 0.11 released (Apache)
  
• [CVE-2019-0218] Apache Pony Mail (incubating) Reflected XSS (Seclist)
  
• Apache Homepage (Apache)
  
• Apache Pony Mai (Incubating) Home Page (Apach)
  
• CVE-2019-0218: Apache Pony Mail (incubating) Reflected XSS (Apache)
  
• Download Apache Pony Mail (Incubating) (Apache)
  
• Pony Mail Github Releases (Github)
  
• Pony Mail Github Repository (Github)