CVE-2022-31470
Medium
Description
An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and retrieve mailbox content.
SeverityMedium
CVSS6.1
Exploit probability—
ProductAxigen Mobile Webmail
PublishedJun 7, 2022
First seenJun 7, 2022
How to fix
Update
- axigen axigen_mobile_webmail10.2.3.12, 10.3.3.47 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| axigen axigen_mobile_webmail | 10.2.2.0 ≤ v < 10.2.3.12, 10.3.3.0 ≤ v < 10.3.3.47 | 10.2.3.12, 10.3.3.47 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.