NetSight
IP …
medium6.1Public exploit code

CVE-2022-31470

An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows att…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and retrieve mailbox content.

Affected products

VendorProductAffected versions
AxigenAxigen Mobile Webmail
from 10.2.2.0 before 10.2.3.12
from 10.3.3.0 before 10.3.3.47

Weakness classification

CWE-79

References