Summary
The host is running Kerio Mail Server and is prone to multiple cross site scripting vulnerabilities.
Impact
Successful exploitation could result in insertion of arbitrary HTML and script code in a user's browser session in the context of an affected site.
Impact Level: Application
Solution
Upgrade to Kerio MailServer 6.6.2
http://www.kerio.com/kms_download.html
Insight
Issues are due to,
- a folder and daytime parameters in mailCompose.php and calendarEdit.php files is not properly sanitised before being returned to the user.
- input passed to the sent parameter in error413.php is not properly sanitised before being returned to the user.
Affected
Kerio MailServer before 6.6.2 on all running platform.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2008-5760, CVE-2008-5769 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities