CVEvulnerability

CVE-2009-1467

4.3 MEDIUM Published 2009-05-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-05-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in server/inc/tools.php; or the (2) title, (3) link, or (4) description element in an RSS feed, related to the getHTML function in server/inc/rss/item.php.

Affected configurations

• icewarp email server (<= 9.3.0) • icewarp email server 2.10.105 • icewarp email server 2.10.110 • icewarp email server 2.10.115 • icewarp email server 2.10.140 • icewarp email server 2.10.150 • icewarp email server 2.10.165 • icewarp email server 2.10.170 • icewarp email server 2.10.190 • icewarp email server 2.10.200 • icewarp email server 2.10.210 • icewarp email server 2.10.220 • icewarp email server 2.10.240 • icewarp email server 2.10.250 • icewarp email server 2.10.260 • icewarp email server 2.10.280 • icewarp email server 2.10.290 • icewarp email server 2.10.310 • icewarp email server 2.10.320 • icewarp email server 2.10.330 • icewarp email server 2.10.331 • icewarp email server 2.10.340 • icewarp email server 2.10.350 • icewarp email server 2.10.360 • icewarp email server 3.00.100 • icewarp email server 3.00.110 • icewarp email server 3.00.120 • icewarp email server 3.00.130 • icewarp email server 3.00.140 • icewarp email server 3.10.011 • icewarp email server 3.10.110 • icewarp email server 4.00.30 • icewarp email server 4.2.1 • icewarp email server 4.2.2 • icewarp email server 4.2.3 • icewarp email server 4.4.1 • icewarp email server 4.4.2 • icewarp email server 4.10.040 • icewarp email server 4.10.050 • icewarp email server 5.1.2 • icewarp email server 5.1.3 • icewarp email server 5.1.5 • icewarp email server 5.3.0 • icewarp email server 5.3.2 • icewarp email server 5.4.1 • icewarp email server 5.4.2 • icewarp email server 5.4.3 • icewarp email server 5.4.4 • icewarp email server 5.5.3 • icewarp email server 5.5.4 • icewarp email server 5.5.5 • icewarp email server 5.5.6 • icewarp email server 5.5.7 • icewarp email server 5.7.3 • icewarp email server 5.8.2 • icewarp email server 5.8.3 • icewarp email server 5.8.4 • icewarp email server 5.8.5 • icewarp email server 5.8.6 • icewarp email server 5.9.4 … and 116 more

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References