Detections
Analytics

SurgeMail surgeweb XSS

medium Nessus Plugin ID 49709

Language:

Synopsis

The remote web server is affected by a cross-site scripting vulnerability.

Description

The remote web server hosts a CGI script that fails to adequately sanitize request strings with malicious JavaScript. By leveraging this issue, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected site.

Solution

Upgrade to SurgeMail 4.3g or later.

See Also

http://ictsec.se/?p=108

http://www.netwinsite.com/surgemail/

Plugin Details

Severity: Medium

ID: 49709

File Name: surgemail_surgeweb_xss.nasl

Version: 1.12

Type: remote

Published: 10/4/2010

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.8

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

Exploit Ease: No exploit is required

Patch Publication Date: 5/26/2010

Vulnerability Publication Date: 10/4/2010

Reference Information

CVE: CVE-2010-3201

BID: 43679

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990