medium4.3Public exploit code
CVE-2013-6017
Cross-site scripting (XSS) vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Atmail Webmail Server - Email Body HTML Injection2014-01-14 · webapps · php · Verified
Impact
Cross-site scripting (XSS) vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Atmail | Atmail | through 7.1.6 Versions 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4 |