CVE-2019-12927

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

0.87%

Published

Jul 8, 2019

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability.

Weaknesses (CWE)

CWE-79

Affected Products (5)

mailenable · mailenable (up to 6.90)vulnerable

mailenable · mailenable (up to 7.62)vulnerable

mailenable · mailenable (up to 8.64)vulnerable

mailenable · mailenable (up to 9.83)vulnerable

mailenable · mailenable (up to 10.24)vulnerable

References (4)

http://www.mailenable.com/Premium-ReleaseNotes.txt

Release NotesVendor Advisory

https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/

Release NotesThird Party Advisory

http://www.mailenable.com/Premium-ReleaseNotes.txt

Release NotesVendor Advisory

https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/

Release NotesThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs