CVE-2019-15072CWE-79

CVE-2019-15072: vulnerability in Openfind MAIL2000

Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor Mail2000

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.5%
The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.
Affected products
Openfind · MAIL2000
Related CVEs — Openfind MAIL2000

In the same product, most dangerous first.

CVE-2019-15071—Openfind MAIL2000 Webmail Pre-Auth Cross-Site ScriptingEPSS 1.6%CVE-2019-15073—Openfind MAIL2000 Webmail Pre-Auth Open RedirectEPSS 1.1%