CVE-2004-2765

Cross-site scripting (XSS) vulnerability in Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, a different vulnerability than CVE-2005-2022 and CVE-2006-5486.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://sunsolve.sun.com/search/document.do?assetkey=1-21-116568-56-1	Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201601-1	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:sun:iplanet_messaging_server:5.2:*:*:*:*:*:*:*

OR	cpe:2.3:o:sun:solaris:2.6::sparc:::::
	cpe:2.3:o:sun:solaris:8.0::sparc:::::

Configuration 2 (hide)

AND

cpe:2.3:a:sun:one_messaging_server:6.1:*:*:*:*:*:*:*

OR	cpe:2.3:o:sun:solaris:8.0::sparc:::::
	cpe:2.3:o:sun:solaris:9.0::sparc:::::

Configuration 3 (hide)

AND

cpe:2.3:a:sun:one_messaging_server:6.1:*:*:*:*:*:*:*

cpe:2.3:o:sun:solaris:9.0:*:x86:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:a:sun:one_messaging_server:6.1:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:2.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2010-01-28 20:30

Updated : 2024-02-04 17:54

NVD link : CVE-2004-2765

Mitre link : CVE-2004-2765

CVE.ORG link : CVE-2004-2765

JSON object : View

Products Affected

sun

one_messaging_server
iplanet_messaging_server
solaris

redhat

enterprise_linux

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2004-2765", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-01-28T20:30:01.043", "references": [{"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-116568-56-1", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-201601-1", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, a different vulnerability than CVE-2005-2022 and CVE-2006-5486."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Webmail en Sun ONE Messaging Server v6.1 e iPlanet Messaging Server v5.2 anterior a 5.2hf2.02, cuando se usa Internet Explorer, permite a atacantes inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de un correo electr\u00f3nico manipulado. Vulnerabilidad distinta de CVE-2005-2022 y CVE-2006-5486."}], "lastModified": "2010-01-31T05:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sun:iplanet_messaging_server:5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AB46EE9-8B54-4C14-8850-C7D5B6C62BBE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sun:solaris:2.6:*:sparc:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C67E67BE-A376-4034-B2DC-DC84E4F2B6E6"}, {"criteria": "cpe:2.3:o:sun:solaris:8.0:*:sparc:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "32CF7469-6D2F-4E34-8013-7F0D3433D0B2"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sun:one_messaging_server:6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2381FAD3-AF24-4A12-9937-9B63B558F473"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sun:solaris:8.0:*:sparc:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "32CF7469-6D2F-4E34-8013-7F0D3433D0B2"}, {"criteria": "cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A711CDC2-412C-499D-9FA6-7F25B06267C6"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sun:one_messaging_server:6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2381FAD3-AF24-4A12-9937-9B63B558F473"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sun:solaris:9.0:*:x86:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0B837BB7-5F62-4CD5-9C64-8553C28EA8A7"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sun:one_messaging_server:6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2381FAD3-AF24-4A12-9937-9B63B558F473"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:2.1:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A423B773-6B8B-4BA3-80A1-C8CAEF4D9BBE"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}