CVE-2022-31470
medium · 6.1A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and retrieve mailbox content.
6.1
CVSS
52.7%
EPSS (exploit prob.)
99th
EPSS percentile
2022-06-07
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| axigen | axigen_mobile_webmail | >= 10.2.2.0, < 10.2.3.12 |
| axigen | axigen_mobile_webmail | >= 10.3.3.0, < 10.3.3.47 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/174551/Axigen-10.5.0-4370c946-Cross-Site-Scripting.html
- https://axigen.com
- https://www.axigen.com/knowledgebase/Axigen-Mobile-WebMail-XSS-Vulnerability-CVE-2022-31470-_390.html
- http://packetstormsecurity.com/files/174551/Axigen-10.5.0-4370c946-Cross-Site-Scripting.html
- https://axigen.com
- https://www.axigen.com/knowledgebase/Axigen-Mobile-WebMail-XSS-Vulnerability-CVE-2022-31470-_390.html
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-31470