| Package | Affected versions | Patched versions |
|---|---|---|
| open webmail | = 1.7= 1.71= 1.8= 1.81= 1.90= 2.00= 2.01= 2.10= 2.20= 2.21= 2.30= 2.31= 2.32= 2.40= 2.41= 2.50≤ 2.51 |
Cross-site scripting (XSS) vulnerability in ow-shared.pl in OpenWebMail (OWM) 2.51 and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter in (1) openwebmail-send.pl, (2) openwebmail-advsearch.pl, (3) openwebmail-folder.pl, (4) openwebmail-prefs.pl, (5) openwebmail-abook.pl, (6) openwebmail-read.pl, (7) openwebmail-cal.pl, and (8) openwebmail-webdisk.pl. NOTE: the openwebmail-main.pl vector is already covered by CVE-2005-2863.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free