CVE-2021-43574

MEDIUMNuclei

Atmail 6.5.0 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-43574 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 2, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMAtmail 6.5.0 - Cross-Site ScriptingCVSS 6.1

Atmail 6.5.0 contains a cross-site scripting vulnerability in WebAdmin Control Pane via the format parameter to the default URI, which allows remote attackers to inject arbitrary web script or HTML via the “format” parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Apply the latest security patches or updates provided by Atmail to fix the XSS vulnerability.

WeaknessesCWE-79
Authorsarafatansari, ritikchaddha
Template tagscve2021cveatmailxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:atmail:atmail:6.5.0:*:*:*:*:*:*:*
Shodan: http.html:"Powered by Atmail"
Shodan: http.html:"powered by atmail"
Shodan: http.html:"atmail"
FOFA: body="powered by atmail"
FOFA: body="atmail"
https://medium.com/@bhattronit96/cve-2021-43574-696041dcab9e https://help.atmail.com/hc/en-us/sections/115003283988 https://nvd.nist.gov/vuln/detail/CVE-2021-43574 https://medium.com/%40bhattronit96/cve-2021-43574-696041dcab9e https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4