Vulnerability Description
MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mailenable | Mailenable | >= 6.0, < 6.90 |
Related Weaknesses (CWE)
References
- http://www.mailenable.com/Premium-ReleaseNotes.txtRelease NotesVendor Advisory
- https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabiRelease NotesThird Party Advisory
- http://www.mailenable.com/Premium-ReleaseNotes.txtRelease NotesVendor Advisory
- https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabiRelease NotesThird Party Advisory
FAQ
What is CVE-2019-12927?
CVE-2019-12927 is a vulnerability with a CVSS score of 6.1 (MEDIUM). MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the s...
How severe is CVE-2019-12927?
CVE-2019-12927 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-12927?
Check the references section above for vendor advisories and patch information. Affected products include: Mailenable Mailenable.