CVE-2009-1467

Published May 5, 2009 CVSS 2.0 · 4.3 Medium EPSS 4.1% KEV · Not listed
Description
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in server/inc/tools.php; or the (2) title, (3) link, or (4) description element in an RSS feed, related to the getHTML function in server/inc/rss/item.php.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2009-1465 Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in server/inc/tools.php; or the (2) title, (3) link, or (4) description element in an RSS feed, related to the getHTML function in server/inc/rss/item.php.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 7, 2024, 5:13 AM
Reserved
Apr 28, 2009, 12:00 AM
Status
Modified
Published
May 5, 2009, 8:30 PM
Modified
Jun 16, 2026, 11:07 PM