medium6.1
CVE-2019-12927
MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks.
Impact
MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mailenable | Mailenable | from 6.0 before 6.90 from 7.0 before 7.62 from 8.00 before 8.64 from 9.0 before 9.83 from 10.00 before 10.24 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.mailenable.com/Premium-ReleaseNotes.txt
- https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/
- http://www.mailenable.com/Premium-ReleaseNotes.txt
- https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/