Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-5734 | First vendor Publication | 2008-12-26 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Cross-site scripting (XSS) vulnerability in WebMail Pro in IceWarp Software Merak Mail Server 9.3.2 allows remote attackers to inject arbitrary web script or HTML via an IMG element in an HTML e-mail message. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5734 |
CAPEC : Common Attack Pattern Enumeration & Classification
| Id | Name |
|---|---|
| CAPEC-18 | Embedding Scripts in Nonscript Elements |
| CAPEC-19 | Embedding Scripts within Scripts |
| CAPEC-32 | Embedding Scripts in HTTP Query Strings |
| CAPEC-63 | Simple Script Injection |
| CAPEC-85 | Client Network Footprinting (using AJAX/XSS) |
| CAPEC-86 | Embedding Script (XSS ) in HTTP Headers |
| CAPEC-91 | XSS in IMG Tags |
| CAPEC-106 | Cross Site Scripting through Log Files |
| CAPEC-198 | Cross-Site Scripting in Error Pages |
| CAPEC-199 | Cross-Site Scripting Using Alternate Syntax |
| CAPEC-209 | Cross-Site Scripting Using MIME Type Mismatch |
| CAPEC-232 | Exploitation of Privilege/Trust |
| CAPEC-243 | Cross-Site Scripting in Attributes |
| CAPEC-244 | Cross-Site Scripting via Encoded URI Schemes |
| CAPEC-245 | Cross-Site Scripting Using Doubled Characters, e.g. %3C%3Cscript |
| CAPEC-246 | Cross-Site Scripting Using Flash |
| CAPEC-247 | Cross-Site Scripting with Masking through Invalid Characters in Identifiers |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-01-09 | Name : Merak Mail Server Web Mail IMG HTML Tag Script Insertion Vulnerability File : nvt/gb_merak_mail_server_script_inj_vuln.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 50885 | IceWarp Merak Mail Server HTML IMG Tag Handling XSS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-12-30 | Name : The remote webmail server is affected by a cross-site scripting vulnerability. File : icewarp_9_4.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:12:36 |
|
| 2024-11-28 12:17:22 |
|
| 2021-05-04 12:08:36 |
|
| 2021-04-22 01:08:57 |
|
| 2020-05-23 00:22:48 |
|
| 2017-08-08 09:24:36 |
|
| 2016-06-28 17:23:36 |
|
| 2016-04-26 18:10:38 |
|
| 2014-02-17 10:47:47 |
|
| 2013-05-11 00:33:44 |
|
