CVE-2004-2334

Multiple cross-site scripting (XSS) vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to inject arbitrary web script or HTML via (1) a hex-encoded value to the variable parameter in emumail.fcgi, (2) the folder parameter in emumail.fcgi, or Javascript in the (3) username or (4) password field in the login page.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2004-12-31

Last modified

2024-08-08

Affected products

• Emu Webmail (Emumail)

References

• http://members.lycos.co.uk/r34ct/main/emu/emu.txt
• http://secunia.com/advisories/11110
• http://securitytracker.com/id?1009397
• http://www.osvdb.org/4204
• http://www.osvdb.org/4972
• http://www.securityfocus.com/bid/9861
• http://www.zone-h.com/advisories/read/id=4141
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15451
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15452