Atmail WebMail < v6.1.9: Reflected XSS in the login process

Users of Atmail WebMail < v6.1.9 please be advised of a Reflected XSS in the login process vulnerability that has been identified.

To view this vulnerability, possible remedies, and others please check out the Security Advisories at Critical Watch (http://criticalwatch.com/support/security-advisories.aspx)

Amplify’d from www.criticalwatch.com

INTERNET SECURITY AUDITORS ALERT 2010-009: Reflected XSS in the login process of the Atmail WebMail < v6.1.9

DESCRIPTION ------------------------- Has been detected a reflected XSS vulnerability in the login process of the Atmail WebMail, that allows the execution of arbitrary HTML/script code to be executed in the context of the victim user's browser. The code injection is done through the "MailType" parameter, and can be exploited without a user account in the WebMail. Read more at www.criticalwatch.com

 

See this Amp at http://bit.ly/d6DFu4