NikoSoft WebMail Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	13811
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 30 2005 12:00AM
Updated:	May 30 2005 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	NikoSoft WebMail 0.10.4 NikoSoft WebMail 0.10.3 NikoSoft WebMail 0.10.2 NikoSoft WebMail 0.10.1 NikoSoft WebMail 0.10
Not Vulnerable:	NikoSoft WebMail 0.11

NikoSoft WebMail Unspecified Cross-Site Scripting Vulnerability

NikoSoft WebMail is affected by an unspecified cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible such as manipulating site content.

NikoSoft WebMail 0.10.4 and prior versions are affected.

NikoSoft WebMail Unspecified Cross-Site Scripting Vulnerability

An exploit is not required.

NikoSoft WebMail Unspecified Cross-Site Scripting Vulnerability

Solution:
The vendor has released version 0.11.0 to address this issue.


NikoSoft WebMail 0.10

• NikoSoft WebMail 0.11.0
  http://www.nikosoft.net/nswm/

NikoSoft WebMail 0.10.1

• NikoSoft WebMail 0.11.0
  http://www.nikosoft.net/nswm/

NikoSoft WebMail 0.10.2

• NikoSoft WebMail 0.11.0
  http://www.nikosoft.net/nswm/

NikoSoft WebMail 0.10.3

• NikoSoft WebMail 0.11.0
  http://www.nikosoft.net/nswm/

NikoSoft WebMail 0.10.4

• NikoSoft WebMail 0.11.0
  http://www.nikosoft.net/nswm/

NikoSoft WebMail Unspecified Cross-Site Scripting Vulnerability

References:

• WebMail Product Page (NikoSoft)