CVE-2019-13392

EPSS 3.9%

Vexday Risk Score

18Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 3.9%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

15 Oct 2019Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid.

Affected products

n/a · n/a

References

https://mindpalette.com/tag/natemail/https://twitter.com/mindpalette https://www.doyler.net/security-not-included/natemail-vulnerabilities