CVE-2014-3878

Multiple cross-site scripting (XSS) vulnerabilities in the web client interface in Ipswitch IMail Server 12.3 and 12.4, possibly before 12.4.1.15, allow remote attackers to inject arbitrary web script or HTML via (1) the Name field in an add new contact action in the Contacts section or unspecified vectors in (2) an Add Group task in the Contacts section, (3) an add new event action in the Calendar section, or (4) the Task section.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

3.47% chance of exploitation in the next 30 days, 88th percentile

Published

2014-06-05

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/33633

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/33633

References

• CVE Record
• NVD entry

Related

• CVE-2014-3875
• CVE-2014-3888
• CVE-2014-3871
• CVE-2014-3913
• CVE-2014-3868
• CVE-2014-3914