IceWarp Mail Server Multiple Cross Site Scripting and XML External Entity Injection Vulnerabilities
BID:60755
Info
IceWarp Mail Server Multiple Cross Site Scripting and XML External Entity Injection Vulnerabilities
| Bugtraq ID: | 60755 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 25 2013 12:00AM |
| Updated: | Jun 25 2013 12:00AM |
| Credit: | V. Paulikas of SEC Consult Vulnerability Lab |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
IceWarp Mail Server Multiple Cross Site Scripting and XML External Entity Injection Vulnerabilities
IceWarp Mail Server is prone to multiple cross-site scripting vulnerabilities and an XML external entity injection vulnerability.
Attackers may exploit these issues to execute arbitrary script code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials and obtain potentially sensitive information from local files; other attacks are also possible.
IceWarp Mail Server 10.4.5 is vulnerable; other versions may also be affected.
IceWarp Mail Server is prone to multiple cross-site scripting vulnerabilities and an XML external entity injection vulnerability.
Attackers may exploit these issues to execute arbitrary script code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials and obtain potentially sensitive information from local files; other attacks are also possible.
IceWarp Mail Server 10.4.5 is vulnerable; other versions may also be affected.
Exploit / POC
IceWarp Mail Server Multiple Cross Site Scripting and XML External Entity Injection Vulnerabilities
An attacker can exploit these issues using a web browser. An attacker must trick an unsuspecting victim into following a malicious URI to exploit the cross-site scripting issues.
An attacker can exploit these issues using a web browser. An attacker must trick an unsuspecting victim into following a malicious URI to exploit the cross-site scripting issues.
Solution / Fix
IceWarp Mail Server Multiple Cross Site Scripting and XML External Entity Injection Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
IceWarp Mail Server Multiple Cross Site Scripting and XML External Entity Injection Vulnerabilities
References:
References:
- IceWarp Homepage (IceWarp)