CVE-2019-13392

MEDIUMNuclei

MindPalette NateMail 3.0.15 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2019-13392 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMMindPalette NateMail 3.0.15 - Cross-Site ScriptingCVSS 6.1

MindPalette NateMail 3.0.15 is susceptible to reflected cross-site scripting which could allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade to the latest version of MindPalette NateMail to fix the XSS vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscvecve2019natemailxssmindpalettevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:mindpalette:natemail:3.0.15:*:*:*:*:*:*:*
https://www.doyler.net/security-not-included/natemail-vulnerabilities https://mindpalette.com/tag/natemail/ https://nvd.nist.gov/vuln/detail/CVE-2019-13392 https://twitter.com/mindpalette https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

4