CVE-2004-2585: XSS
First published: Fri Dec 31 2004(Updated: )
Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web script or HTML via Javascript to the "check spelling" feature in the compose area.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SmarterTools SmarterMail Enterprise | =1.6.1511 | |
| SmarterTools SmarterMail Enterprise | =1.6.1529 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://members.lycos.co.uk/r34ct/main/smarter_mail%203.1/smarter_mail.txt
- http://www.zone-h.org/advisories/read/id=4098
- http://www.securityfocus.com/bid/9805
- http://www.osvdb.org/4145
- http://securitytracker.com/id?1009307
- http://secunia.com/advisories/11042
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15393
Frequently Asked Questions
What is the severity of CVE-2004-2585?
The severity of CVE-2004-2585 is classified as a moderate risk due to the potential for cross-site scripting attacks.
How do I fix CVE-2004-2585?
To fix CVE-2004-2585, you should upgrade to a version of SmarterMail that is not affected, preferably beyond 1.6.1529.
What type of vulnerability is CVE-2004-2585?
CVE-2004-2585 is a cross-site scripting (XSS) vulnerability allowing remote attackers to inject arbitrary web scripts.
Which versions of SmarterMail are affected by CVE-2004-2585?
CVE-2004-2585 affects SmarterMail versions 1.6.1511 and 1.6.1529.
What can attackers achieve with CVE-2004-2585?
With CVE-2004-2585, attackers can execute untrusted scripts in the context of users' sessions, compromising user data and security.
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/last-modified-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/smartertools
- canonical/smartertools smartermail enterprise
- version/smartertools smartermail enterprise/1.6.1511
- version/smartertools smartermail enterprise/1.6.1529