CVE-2002-1958

Cross-site scripting (XSS) vulnerability in kmMail 1.0, 1.0a, and 1.0b allows remote attackers to inject arbitrary web script or HTML via (1) javascript in onmouseover or other attributes in "safe" HTML tags such as the "b" tag, or (2) the Subject field.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://lists.grok.org.uk/pipermail/full-disclosure/2002-October/002207.html
http://sourceforge.net/forum/forum.php?forum_id=191501	Patch
http://www.iss.net/security_center/static/9507.php	Patch
http://www.securityfocus.com/bid/5173	Patch
http://www.securityfocus.com/bid/6013
http://lists.grok.org.uk/pipermail/full-disclosure/2002-October/002207.html
http://sourceforge.net/forum/forum.php?forum_id=191501	Patch
http://www.iss.net/security_center/static/9507.php	Patch
http://www.securityfocus.com/bid/5173	Patch
http://www.securityfocus.com/bid/6013

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:kmmail:kmmail:1.0:::::::*
	cpe:2.3:a:kmmail:kmmail:1.0a:::::::*
	cpe:2.3:a:kmmail:kmmail:1.0b:::::::*

History

20 Nov 2024, 23:42

Type	Values Removed	Values Added
References	~~() http://lists.grok.org.uk/pipermail/full-disclosure/2002-October/002207.html -~~	() http://lists.grok.org.uk/pipermail/full-disclosure/2002-October/002207.html -
References	~~() http://sourceforge.net/forum/forum.php?forum_id=191501 - Patch~~	() http://sourceforge.net/forum/forum.php?forum_id=191501 - Patch
References	~~() http://www.iss.net/security_center/static/9507.php - Patch~~	() http://www.iss.net/security_center/static/9507.php - Patch
References	~~() http://www.securityfocus.com/bid/5173 - Patch~~	() http://www.securityfocus.com/bid/5173 - Patch
References	~~() http://www.securityfocus.com/bid/6013 -~~	() http://www.securityfocus.com/bid/6013 -

Information

Published : 2002-12-31 05:00

Updated : 2024-11-20 23:42

NVD link : CVE-2002-1958

Mitre link : CVE-2002-1958

CVE.ORG link : CVE-2002-1958

JSON object : View

Products Affected

kmmail

kmmail

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2002-1958", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2002-12-31T05:00:00.000", "references": [{"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-October/002207.html", "source": "cve@mitre.org"}, {"url": "http://sourceforge.net/forum/forum.php?forum_id=191501", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/9507.php", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/5173", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/6013", "source": "cve@mitre.org"}, {"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2002-October/002207.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://sourceforge.net/forum/forum.php?forum_id=191501", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.iss.net/security_center/static/9507.php", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/5173", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/6013", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in kmMail 1.0, 1.0a, and 1.0b allows remote attackers to inject arbitrary web script or HTML via (1) javascript in onmouseover or other attributes in \"safe\" HTML tags such as the \"b\" tag, or (2) the Subject field."}], "lastModified": "2024-11-20T23:42:31.420", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kmmail:kmmail:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4996C23-052A-4514-9DC0-E37498BC10CE"}, {"criteria": "cpe:2.3:a:kmmail:kmmail:1.0a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5761311C-48DE-4310-92A0-7E670B7BD476"}, {"criteria": "cpe:2.3:a:kmmail:kmmail:1.0b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B747B6E-7B5E-4B8C-AEE5-963E81743B39"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}