Secunia

A vulnerability has been discovered in Open WebMail, which can be exploited by malicious people to conduct script injection attacks.

The vulnerability is caused due to missing input validation of the "Content-Type:" header. This can be exploited via specially crafted emails containing HTML or script code in the "Content-Type:" header to execute the code in a user's browser session in context of a vulnerable site, when the malicious email is viewed.

The vulnerability has been reported in version 2.32. Prior versions may also be affected.

Solution
The vulnerability has been fixed in the latest openwebmail-current.tgz:
Further details available in Customer Area

Provided and/or discovered by
Originally discovered in SquirrelMail by:
Román Medina-Heigl Hernández

Reported in Open WebMail by:
aramosf

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area