Secunia

Some vulnerabilities have been reported in Active! Mail 2003, which can be exploited by malicious people to conduct cross-site scripting attacks or hijack a session.

1) Certain input passed via unspecified parameters is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) An unspecified error can be exploited to hijack session IDs by sending a specially crafted URL when a logged in user checks his email using a mobile phone.

The vulnerabilities are reported in version 2003.0139.0871. Other versions may also be affected.

Solution
Update to version 2003.0139.0939.

Provided and/or discovered by
JVN Credits Maebashi Keniti, Ministry of Information Sciences Hosei University.

Changelog
Further details available in Customer Area

Original Advisory
JVN:
http://jvn.jp/en/jp/JVN49083120/index.html
http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000075.html
http://jvn.jp/en/jp/JVN85821104/index.html
http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000076.html

TransWARE:
http://www.transware.co.jp/support_am/security/vulnerability2.html
http://www.transware.co.jp/support_am/security/vulnerability3.html

Deep Links
Links available in Customer Area