CVE-2019-12927: XSS
MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12927?
CVE-2019-12927 is classified as a medium severity vulnerability due to its potential for session hijacking.
How do I fix CVE-2019-12927?
To fix CVE-2019-12927, upgrade MailEnable Enterprise Premium to version 10.24 or later.
What types of attacks are possible with CVE-2019-12927?
CVE-2019-12927 is vulnerable to both stored and reflected cross-site scripting (XSS) attacks.
Which versions of MailEnable Enterprise Premium are affected by CVE-2019-12927?
Versions of MailEnable Enterprise Premium from 6.0 to 10.24 are affected by CVE-2019-12927.
What is the underlying issue in CVE-2019-12927?
The underlying issue in CVE-2019-12927 is the absence of the HttpOnly flag on the session cookie, making it vulnerable to theft.