Summary
AfterLogic WebMail Pro is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie- based authentication credentials
other attacks are also possible.
AfterLogic WebMail Pro 4.7.10 and prior versions are affected.
Solution
Reports indicate that the vendor addressed these issues in WebMail Pro 4.7.11, but Symantec has not confirmed this. Please contact the vendor for more information.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2009-4743 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities
- Aardvark Topsites PHP 'index.php' Multiple Cross Site Scripting Vulnerabilities
- Apache Tomcat cal2.jsp Cross Site Scripting Vulnerability
- Apache Struts Cross Site Scripting Vulnerability
- Adobe ColdFusion Multiple Full Path Disclosure Vulnerabilities
- Aardvark Topsites <= 4.2.2 Remote File Inclusion Vulnerability