IceWarp Merak Mail Server 'item.php' Cross-Site Scripting Vulnerability

Bugtraq ID:	34825
Class:	Input Validation Error
CVE:	CVE-2009-1467
Remote:	Yes
Local:	No
Published:	May 05 2009 12:00AM
Updated:	May 06 2009 05:56PM
Credit:	RedTeam Pentesting GmbH
Vulnerable:	IceWarp Merak Mail Server 9.4.1
Not Vulnerable:	IceWarp Merak Mail Server 9.4.2

IceWarp Merak Mail Server 'item.php' Cross-Site Scripting Vulnerability

IceWarp Merak Mail Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.

IceWarp Merak Mail Server 'item.php' Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to open a malicious email.

The following example data is available:

• /data/vulnerabilities/exploits/34825.xml

IceWarp Merak Mail Server 'item.php' Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for details.

IceWarp Merak Mail Server 'item.php' Cross-Site Scripting Vulnerability

References:

• Merak Mail Server Homepage (IceWarp)
  
• [RT-SA-2009-002] IceWarp WebMail Server: User-assisted Cross Site Scripting in R (RedTeam Pentesting GmbH )