VulnerabilityDeferred

CVE-2023-49780

Cross-site scripting vulnerability exists in acmailer CGI ver.4.0.5 and earlier.

MEDIUM 6.1EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-site scripting vulnerability exists in acmailer CGI ver.4.0.5 and earlier. An arbitrary script may be executed on the web browser of the user who accessed the management page of the affected product.

CVSS 3.0: 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.29% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: vultures@jpcert.or.jp

References

https://acmailer.jp/info/de.cgi?id=113
https://jvn.jp/en/jp/JVN84319378/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.