CVE-2006-2190 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2006-2190
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2006-2190

Description: Cross-site scripting (XSS) vulnerability in ow-shared.pl in OpenWebMail (OWM) 2.51 and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter in (1) openwebmail-send.pl, (2) openwebmail-advsearch.pl, (3) openwebmail-folder.pl, (4) openwebmail-prefs.pl, (5) openwebmail-abook.pl, (6) openwebmail-read.pl, (7) openwebmail-cal.pl, and (8) openwebmail-webdisk.pl. NOTE: the openwebmail-main.pl vector is already covered by CVE-2005-2863.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/26105 SAID Secunia Advisory: SA16734 MLIST http://openwebmail.acatysmoof.com/archive/html/owm-announce/owm-announce.200605/msg00000.html MISC http://pridels.blogspot.com/2006/04/open-webmail-251-xss-vuln.html CONFIRM http://openwebmail.acatysmoof.com/dev/svn/index.pl/openwebmail/diff/trunk/src/cgi-bin/openwebmail/shares/ow-shared.pl?rev1=232;rev2=233 http://openwebmail.acatysmoof.com/dev/svn/index.pl/openwebmail/log/trunk/?rev=233&limit=33

Return to the previous page.