Detections
Analytics
Open WebMail sessionid Parameter XSS
medium Nessus Plugin ID 19769
Language:
Synopsis
The remote web server contains a PHP script which is vulnerable to a cross-site scripting attack.Description
The installed version of Open WebMail on the remote host is prone to cross-site scripting attacks because it fails to sanitize user- supplied input to the 'sessionid' parameter of the 'openwebmail-main.pl' script.Solution
Unknown at this time.See Also
http://online.securityfocus.com/archive/1/409692/30/0/threaded
Plugin Details
Severity: Medium
ID: 19769
File Name: openwebmail_sessionid_xss.nasl
Version: 1.18
Type: remote
Family: CGI abuses : XSS
Published: 9/21/2005
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 2.7
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 9/3/2005
Reference Information
CVE: CVE-2005-2863
BID: 14771