CVE-2017-16962: XSS
The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16962?
CVE-2017-16962 is classified with a medium severity due to its potential for stored cross-site scripting exploitation.
How do I fix CVE-2017-16962?
To fix CVE-2017-16962, upgrade CommuniGate Pro to version 6.2.1 or later to mitigate the stored XSS vulnerabilities.
What components are affected by CVE-2017-16962?
CVE-2017-16962 impacts the WebMail components of CommuniGate Pro, specifically Crystal, pronto, and pronto4.
What types of attacks can be executed through CVE-2017-16962?
CVE-2017-16962 allows attackers to execute stored XSS attacks via crafted Google Calendar or Outlook.com calendar invitations and emails.
Is user input validation impacted by CVE-2017-16962?
Yes, CVE-2017-16962 indicates that user input validation in certain fields of CommuniGate Pro is insufficient, leading to XSS vulnerabilities.