Unscored CVE-2019-12927 EUVD-2019-4504GHSA-rmqc-x4mr-hg5m

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie d…

Published Jul 8, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Description

MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability.

References

http://www.mailenable.com/Premium-ReleaseNotes.txt
https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/