Search
Find a vulnerability
Search criteria
6 vulnerabilities found for mail2000 by openfind
CVE-2023-28705 (GCVE-0-2023-28705)
Vulnerability from cvelistv5 – Published: 2023-06-02 00:00 – Updated: 2025-01-08 20:02
VLAI
EPSS
VEX
Title
Openfind Mail2000 - XSS (Reflected Cross-site scripting)
Summary
Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it triggers an XSS (Reflected Cross-site scripting) attack.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-08 20:02 UTC
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
twcert
CNA
References
1 reference
Impacted products
Date Public
2023-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T13:43:23.778Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7158-751a6-1.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28705",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-08T20:02:22.789681Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-08T20:02:33.928Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mail2000",
"vendor": "Openfind",
"versions": [
{
"lessThanOrEqual": "7",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2023-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it triggers an XSS (Reflected Cross-site scripting) attack."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-02T00:00:00.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7158-751a6-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Openfind Mail2000 version to V8"
}
],
"source": {
"advisory": "TVN-202306001",
"discovery": "EXTERNAL"
},
"title": "Openfind Mail2000 - XSS (Reflected Cross-site scripting)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-28705",
"datePublished": "2023-06-02T00:00:00.000Z",
"dateReserved": "2023-03-21T00:00:00.000Z",
"dateUpdated": "2025-01-08T20:02:33.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-22902 (GCVE-0-2023-22902)
Vulnerability from cvelistv5 – Published: 2023-03-27 00:00 – Updated: 2025-02-19 16:28
VLAI
EPSS
VEX
Title
Openfind Mail2000 - XSS
Summary
Openfind Mail2000 file uploading function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject JavaScript, conducting an XSS attack.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-19 16:28 UTC
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
twcert
CNA
References
1 reference
Date Public
2023-02-24 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:20:31.423Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-6953-79236-1.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-22902",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-19T16:28:26.624540Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T16:28:31.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mail2000",
"vendor": "Openfind",
"versions": [
{
"status": "affected",
"version": "7"
},
{
"status": "affected",
"version": "8"
}
]
}
],
"datePublic": "2023-02-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Openfind Mail2000 file uploading function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject JavaScript, conducting an XSS attack."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-27T00:00:00.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-6953-79236-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mail2000 version to latest"
}
],
"source": {
"advisory": "TVN-202302001",
"discovery": "EXTERNAL"
},
"title": "Openfind Mail2000 - XSS",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-22902",
"datePublished": "2023-03-27T00:00:00.000Z",
"dateReserved": "2023-01-10T00:00:00.000Z",
"dateUpdated": "2025-02-19T16:28:31.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-12776 (GCVE-0-2020-12776)
Vulnerability from cvelistv5 – Published: 2020-09-01 08:10 – Updated: 2024-09-17 04:14
VLAI
EPSS
VEX
Title
Openfind Mail2000 - Broken Access Control
Summary
Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie.
Severity
6.6 (Medium)
CWE
- Broken Access Control
Assigner
twcert
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-3897-01d73-1.html | x_refsource_MISC |
Date Public
2020-09-01 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:04:22.909Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-3897-01d73-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Mail2000",
"vendor": "Openfind",
"versions": [
{
"lessThanOrEqual": "7.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-09-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Broken Access Control",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-01T08:10:17.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-3897-01d73-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Patch to 091 of SP4, or contact with Openfind."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Openfind Mail2000 - Broken Access Control",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2020-09-01T08:00:00.000Z",
"ID": "CVE-2020-12776",
"STATE": "PUBLIC",
"TITLE": "Openfind Mail2000 - Broken Access Control"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Mail2000",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "7.0"
}
]
}
}
]
},
"vendor_name": "Openfind"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Broken Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-3897-01d73-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-3897-01d73-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Patch to 091 of SP4, or contact with Openfind."
}
],
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2020-12776",
"datePublished": "2020-09-01T08:10:17.915Z",
"dateReserved": "2020-05-11T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:14:37.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-15072 (GCVE-0-2019-15072)
Vulnerability from cvelistv5 – Published: 2019-11-20 04:16 – Updated: 2024-09-17 01:37
VLAI
EPSS
VEX
Title
Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting
Summary
The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.
Severity
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
twcert
CNA
References
6 references
| URL | Tags |
|---|---|
| https://www.openfind.com.tw/taiwan/resource.html | x_refsource_CONFIRM |
| https://gist.github.com/chtsecurity/b3396500d4686… | x_refsource_CONFIRM |
| https://gist.github.com/tonykuo76/5bf1ac369d953d5… | x_refsource_CONFIRM |
| https://www.chtsecurity.com/download/0837ce00c27c… | x_refsource_CONFIRM |
| https://tvn.twcert.org.tw/taiwanvn/TVN-201909002 | x_refsource_CONFIRM |
| https://www.twcert.org.tw/en/cp-128-3086-ff35d-2.html | x_refsource_CONFIRM |
Impacted products
Date Public
2019-11-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T00:34:53.157Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.openfind.com.tw/taiwan/resource.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/chtsecurity/b3396500d4686ad47fb26f64967ef24a"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/tonykuo76/5bf1ac369d953d5276afe0a2d04c2147"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/download/0837ce00c27c73dd3ba3a0d4a7df3a41aaea1ac1e9831a5d61bb64ed484a3598.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909002"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.twcert.org.tw/en/cp-128-3086-ff35d-2.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MAIL2000",
"vendor": "Openfind",
"versions": [
{
"lessThan": "Before 20190919",
"status": "affected",
"version": "6.0",
"versionType": "custom"
},
{
"lessThan": "SP4 Patch 076",
"status": "affected",
"version": "7.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tony Kuo (CHT Security), Vtim (CHT Security)"
}
],
"datePublic": "2019-11-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The login feature in \"/cgi-bin/portal\" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-20T04:16:18.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.openfind.com.tw/taiwan/resource.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/chtsecurity/b3396500d4686ad47fb26f64967ef24a"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/tonykuo76/5bf1ac369d953d5276afe0a2d04c2147"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/download/0837ce00c27c73dd3ba3a0d4a7df3a41aaea1ac1e9831a5d61bb64ed484a3598.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909002"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.twcert.org.tw/en/cp-128-3086-ff35d-2.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2019-11-11T04:00:00.000Z",
"ID": "CVE-2019-15072",
"STATE": "PUBLIC",
"TITLE": "Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MAIL2000",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "6.0",
"version_value": "Before 20190919"
},
{
"version_affected": "\u003c",
"version_name": "7.0",
"version_value": "SP4 Patch 076"
}
]
}
}
]
},
"vendor_name": "Openfind"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tony Kuo (CHT Security), Vtim (CHT Security)"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The login feature in \"/cgi-bin/portal\" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.openfind.com.tw/taiwan/resource.html",
"refsource": "CONFIRM",
"url": "https://www.openfind.com.tw/taiwan/resource.html"
},
{
"name": "https://gist.github.com/chtsecurity/b3396500d4686ad47fb26f64967ef24a",
"refsource": "CONFIRM",
"url": "https://gist.github.com/chtsecurity/b3396500d4686ad47fb26f64967ef24a"
},
{
"name": "https://gist.github.com/tonykuo76/5bf1ac369d953d5276afe0a2d04c2147",
"refsource": "CONFIRM",
"url": "https://gist.github.com/tonykuo76/5bf1ac369d953d5276afe0a2d04c2147"
},
{
"name": "https://www.chtsecurity.com/download/0837ce00c27c73dd3ba3a0d4a7df3a41aaea1ac1e9831a5d61bb64ed484a3598.txt",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/download/0837ce00c27c73dd3ba3a0d4a7df3a41aaea1ac1e9831a5d61bb64ed484a3598.txt"
},
{
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909002",
"refsource": "CONFIRM",
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909002"
},
{
"name": "https://www.twcert.org.tw/en/cp-128-3086-ff35d-2.html",
"refsource": "CONFIRM",
"url": "https://www.twcert.org.tw/en/cp-128-3086-ff35d-2.html"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2019-15072",
"datePublished": "2019-11-20T04:16:18.705Z",
"dateReserved": "2019-08-15T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:37:01.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-15073 (GCVE-0-2019-15073)
Vulnerability from cvelistv5 – Published: 2019-11-20 04:16 – Updated: 2024-09-17 03:37
VLAI
EPSS
VEX
Title
Openfind MAIL2000 Webmail Pre-Auth Open Redirect
Summary
An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities.
Severity
No CVSS data available.
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
twcert
CNA
References
6 references
| URL | Tags |
|---|---|
| https://www.openfind.com.tw/taiwan/resource.html | x_refsource_CONFIRM |
| https://gist.github.com/chtsecurity/512ebad24dddf… | x_refsource_CONFIRM |
| https://gist.github.com/tonykuo76/ed1cc21cf755bfb… | x_refsource_CONFIRM |
| https://www.chtsecurity.com/download/258686130f7a… | x_refsource_CONFIRM |
| https://www.twcert.org.tw/en/cp-128-3087-5cecd-2.html | x_refsource_CONFIRM |
| https://tvn.twcert.org.tw/taiwanvn/TVN-201909003 | x_refsource_CONFIRM |
Impacted products
Date Public
2019-11-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T00:34:53.237Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.openfind.com.tw/taiwan/resource.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/chtsecurity/512ebad24dddffb5321cf5f1a336f90f"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/tonykuo76/ed1cc21cf755bfb8b67ca24f50bded13"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/download/258686130f7a16063c765f9e79cffd813409f6fe61c2dec05fceca541762d5bd.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.twcert.org.tw/en/cp-128-3087-5cecd-2.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909003"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MAIL2000",
"vendor": "Openfind",
"versions": [
{
"lessThan": "Before 20190919",
"status": "affected",
"version": "6.0",
"versionType": "custom"
},
{
"lessThan": "SP4 Patch 076",
"status": "affected",
"version": "7.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tony Kuo (CHT Security), Vtim (CHT Security)"
}
],
"datePublic": "2019-11-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-20T04:16:09.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.openfind.com.tw/taiwan/resource.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/chtsecurity/512ebad24dddffb5321cf5f1a336f90f"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/tonykuo76/ed1cc21cf755bfb8b67ca24f50bded13"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/download/258686130f7a16063c765f9e79cffd813409f6fe61c2dec05fceca541762d5bd.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.twcert.org.tw/en/cp-128-3087-5cecd-2.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909003"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Openfind MAIL2000 Webmail Pre-Auth Open Redirect",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2019-11-11T04:00:00.000Z",
"ID": "CVE-2019-15073",
"STATE": "PUBLIC",
"TITLE": "Openfind MAIL2000 Webmail Pre-Auth Open Redirect"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MAIL2000",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "6.0",
"version_value": "Before 20190919"
},
{
"version_affected": "\u003c",
"version_name": "7.0",
"version_value": "SP4 Patch 076"
}
]
}
}
]
},
"vendor_name": "Openfind"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tony Kuo (CHT Security), Vtim (CHT Security)"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.openfind.com.tw/taiwan/resource.html",
"refsource": "CONFIRM",
"url": "https://www.openfind.com.tw/taiwan/resource.html"
},
{
"name": "https://gist.github.com/chtsecurity/512ebad24dddffb5321cf5f1a336f90f",
"refsource": "CONFIRM",
"url": "https://gist.github.com/chtsecurity/512ebad24dddffb5321cf5f1a336f90f"
},
{
"name": "https://gist.github.com/tonykuo76/ed1cc21cf755bfb8b67ca24f50bded13",
"refsource": "CONFIRM",
"url": "https://gist.github.com/tonykuo76/ed1cc21cf755bfb8b67ca24f50bded13"
},
{
"name": "https://www.chtsecurity.com/download/258686130f7a16063c765f9e79cffd813409f6fe61c2dec05fceca541762d5bd.txt",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/download/258686130f7a16063c765f9e79cffd813409f6fe61c2dec05fceca541762d5bd.txt"
},
{
"name": "https://www.twcert.org.tw/en/cp-128-3087-5cecd-2.html",
"refsource": "CONFIRM",
"url": "https://www.twcert.org.tw/en/cp-128-3087-5cecd-2.html"
},
{
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909003",
"refsource": "CONFIRM",
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909003"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2019-15073",
"datePublished": "2019-11-20T04:16:09.274Z",
"dateReserved": "2019-08-15T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:37:27.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-15071 (GCVE-0-2019-15071)
Vulnerability from cvelistv5 – Published: 2019-11-20 04:06 – Updated: 2024-09-17 00:10
VLAI
EPSS
VEX
Title
Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting
Summary
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities.
Severity
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
twcert
CNA
References
8 references
| URL | Tags |
|---|---|
| https://gist.github.com/tonykuo76/95638395e0c83e6… | x_refsource_CONFIRM |
| https://www.openfind.com.tw/taiwan/resource.html | x_refsource_CONFIRM |
| https://gist.github.com/chtsecurity/21119b393640b… | x_refsource_CONFIRM |
| https://www.chtsecurity.com/download/5011077112c7… | x_refsource_CONFIRM |
| https://www.twcert.org.tw/en/cp-128-3085-45bda-2.html | x_refsource_CONFIRM |
| https://tvn.twcert.org.tw/taiwanvn/TVN-201909001 | x_refsource_CONFIRM |
| https://www.openfind.com.tw/taiwan/download/m2k/p… | x_refsource_MISC |
| https://www.openfind.com.tw/taiwan/download/m2k/p… | x_refsource_MISC |
Impacted products
Date Public
2019-11-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T00:34:53.173Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.openfind.com.tw/taiwan/resource.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216d"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.twcert.org.tw/en/cp-128-3085-45bda-2.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909001"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MAIL2000",
"vendor": "Openfind",
"versions": [
{
"lessThan": "Before 20190919",
"status": "affected",
"version": "6.0",
"versionType": "custom"
},
{
"lessThan": "SP4 Patch 076",
"status": "affected",
"version": "7.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tony Kuo (CHT Security), Vtim (CHT Security)"
}
],
"datePublic": "2019-11-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The \"/cgi-bin/go\" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-22T15:19:49.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.openfind.com.tw/taiwan/resource.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216d"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.twcert.org.tw/en/cp-128-3085-45bda-2.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909001"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2019-11-11T04:00:00.000Z",
"ID": "CVE-2019-15071",
"STATE": "PUBLIC",
"TITLE": "Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MAIL2000",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "6.0",
"version_value": "Before 20190919"
},
{
"version_affected": "\u003c",
"version_name": "7.0",
"version_value": "SP4 Patch 076"
}
]
}
}
]
},
"vendor_name": "Openfind"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tony Kuo (CHT Security), Vtim (CHT Security)"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The \"/cgi-bin/go\" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27",
"refsource": "CONFIRM",
"url": "https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27"
},
{
"name": "https://www.openfind.com.tw/taiwan/resource.html",
"refsource": "CONFIRM",
"url": "https://www.openfind.com.tw/taiwan/resource.html"
},
{
"name": "https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216d",
"refsource": "CONFIRM",
"url": "https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216d"
},
{
"name": "https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt"
},
{
"name": "https://www.twcert.org.tw/en/cp-128-3085-45bda-2.html",
"refsource": "CONFIRM",
"url": "https://www.twcert.org.tw/en/cp-128-3085-45bda-2.html"
},
{
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909001",
"refsource": "CONFIRM",
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201909001"
},
{
"name": "https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf",
"refsource": "MISC",
"url": "https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf"
},
{
"name": "https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf",
"refsource": "MISC",
"url": "https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2019-15071",
"datePublished": "2019-11-20T04:06:20.948Z",
"dateReserved": "2019-08-15T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:10:30.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}