NVD脆弱性詳細

CVE-2007-0651

概要	Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Professional before 2.37 allow remote attackers to inject arbitrary Javascript script via (1) e-mail messages and (2) the ID parameter to (a) right.asp, (b) Forms/MAI/list.asp, and (c) Forms/VCF/list.asp in mewebmail/base/default/lang/EN/.
公表日	2007年2月16日8:28
登録日	2021年1月29日14:06
最終更新日	2018年10月17日1:33

CVSS2.0 : MEDIUM
スコア	4.3
ベクター	AV:N/AC:M/Au:N/C:N/I:P/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	低
可用性への影響(A)	なし
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	はい

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:mailenable:mailenable_professional:1.0.004:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.005:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.006:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.007:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.008:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.009:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.010:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.011:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.012:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.013:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.014:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.015:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.016:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.017:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.1:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.2:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.2a:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.5:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.6:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.7:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.12:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.13:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.14:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.15:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.16:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.17:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.18:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.19:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.51:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.52:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.53:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.54:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.72:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.73:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.82:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.83:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.84:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.101:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.102:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.103:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.104:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.105:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.106:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.107:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.108:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.109:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.110:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.111:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.112:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.113:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.114:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.115:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.116:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.0:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.1:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.2:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.32:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.33:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.34:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.35:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.351:::::::*

関連情報、対策とツール

No	URL	refsource	タグ
1	http://osvdb.org/33188	OSVDB
2	http://osvdb.org/33189	OSVDB
3	http://osvdb.org/33190	OSVDB
4	http://secunia.com/advisories/23998	SECUNIA	Patch Vendor Advisory
5	http://secunia.com/secunia_research/2007-38/advisory/	MISC	Patch Vendor Advisory
6	http://securityreason.com/securityalert/2258	SREASON
7	http://www.mailenable.com/Professional20-ReleaseNotes.txt	CONFIRM
8	http://www.securityfocus.com/archive/1/460063/100/0/threaded	BUGTRAQ
9	http://www.securityfocus.com/bid/22554	BID
10	http://www.vupen.com/english/advisories/2007/0595	VUPEN
11	https://exchange.xforce.ibmcloud.com/vulnerabilities/32476	XF
12	https://exchange.xforce.ibmcloud.com/vulnerabilities/32480	XF

共通脆弱性一覧

JVN脆弱性情報

MailEnable Professional におけるクロスサイトスクリプティングの脆弱性

タイトル	MailEnable Professional におけるクロスサイトスクリプティングの脆弱性
概要	MailEnable Professional には、クロスサイトスクリプティングの脆弱性が存在します。
想定される影響	第三者により、以下を介して、任意の Javascript スクリプトを挿入される可能性があります。 (1) e-mail メッセージ (2) mewebmail/base/default/lang/EN/ 配下の right.asp、Forms/MAI/list.asp、Forms/VCF/list.asp への ID パラメータ
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2007年2月15日0:00
登録日	2012年9月25日16:47
最終更新日	2012年9月25日16:47

影響を受けるシステム

MailEnable

mailenable professional 2.37 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2007-0651	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0651
National Vulnerability Database (NVD)
2	CVE-2007-0651	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-0651

ベンダー情報

No	名前	URL
MailEnable
1	RELEASE NOTES	http://www.mailenable.com/Professional1-ReleaseNotes.txt

変更履歴

No	変更内容	変更日
0	[2012年09月25日] 掲載	2018年2月17日10:37

構成1	以上	以下	より上	未満
cpe:2.3:a:mailenable:mailenable_professional:1.0.004:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.005:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.006:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.007:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.008:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.009:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.010:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.011:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.012:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.013:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.014:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.015:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.016:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.0.017:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.1:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.2:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.2a:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.5:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.6:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.7:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.12:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.13:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.14:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.15:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.16:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.17:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.18:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.19:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.51:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.52:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.53:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.54:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.72:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.73:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.82:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.83:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.84:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.101:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.102:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.103:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.104:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.105:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.106:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.107:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.108:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.109:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.110:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.111:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.112:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.113:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.114:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.115:::::::*
cpe:2.3:a:mailenable:mailenable_professional:1.116:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.0:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.1:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.2:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.32:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.33:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.34:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.35:::::::*
cpe:2.3:a:mailenable:mailenable_professional:2.351:::::::*