GitHub Advisoryadvisory · Maven

GHSA-7crp-p2vc-69r7 Apache James Hupa Webmail application Cross-site Scripting Vulnerabilities

MEDIUM Published 2022-05-14 Modified 2023-08-29 Official page ↗
Aliases
CVE-2012-3536
Ecosystem
Maven
Packages
org.apache.james.hupa:hupa-parent
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-08-29

Affected packages

• Maven org.apache.james.hupa:hupa-parent: < 0.0.3 → fixed in 0.0.3

Description

Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of messages were viewed. This issue was addressed in Hupa 0.0.3.

Related

Alias · CVE (1)

  • CVE-2012-3536 Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References