CVE-2019-15071CWE-79

CVE-2019-15071: vulnerability in Openfind MAIL2000

Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor Mail2000

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.6%
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities.
Affected products
Openfind · MAIL2000
Related CVEs — Openfind MAIL2000

In the same product, most dangerous first.

CVE-2019-15072—Openfind MAIL2000 Webmail Post-Auth Cross-Site ScriptingEPSS 1.5%CVE-2019-15073—Openfind MAIL2000 Webmail Pre-Auth Open RedirectEPSS 1.1%