FloosieTek FTGatePro Mail Server Cross-Site Scripting Vulnerability

Bugtraq ID:	8528
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 02 2003 12:00AM
Updated:	Sep 02 2003 12:00AM
Credit:	Discovery is credited to Ziv Kamir <[email protected]>.
Vulnerable:	Floosietek FTGatePro 1.22 (1331)
Not Vulnerable:

FloosieTek FTGatePro Mail Server Cross-Site Scripting Vulnerability

FloosieTek FTGatePro Mail Server is prone to a cross-site scripting vulnerability. A remote attacker could exploit this issue by enticing a legitimate user of the mail server to follow a malicious link with embedded HTML and script code. The attacker-supplied code would potentially be rendered in the user's browser when the link is followed.

This issue exists in the web administrative interface, which listens on port 8089 by default.

FloosieTek FTGatePro Mail Server Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

FloosieTek FTGatePro Mail Server Cross-Site Scripting Vulnerability

References:

• FTGate Homepage (Floosietek)