vendor:
Uebimiau Webmail
by:
cp77fk4r
8,8
CVSS
HIGH
Cross Site Scripting, Directory Listing, Full Path Disclosure
79, 522, 200
CWE
Product Name: Uebimiau Webmail
Affected Version From: 2.7.2
Affected Version To: 2.7.2
Patch Exists: YES
Related CWE: N/A
CPE: a:uebimiau:uebimiau_webmail
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: PHP
2010
Uebimiau Webmail <= 2.7.2 Multiple Vulnerabilities
Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites. Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user in the output it generates without validating or encoding it. Directory Listing enables the attacker to view the directory structure of the web application. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file.
Mitigation:
Input validation, Output encoding, File permissions, File integrity monitoring, Web application firewalls, Security logging and monitoring
