CVE-2019-15071: Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-20 · updated 2026-06-17
Weakness: CWE-79

Description

The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities.

Affected products

Openfind Mail2000 V8.0: from 6.0 through 7.0

References

https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216d
https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27
https://tvn.twcert.org.tw/taiwanvn/TVN-201909001
https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt
https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf
https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf
https://www.openfind.com.tw/taiwan/resource.html
https://www.twcert.org.tw/en/cp-128-3085-45bda-2.html
https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216d
https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27
https://tvn.twcert.org.tw/taiwanvn/TVN-201909001
https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt

Get alerted when CVE-2019-15071 or the next vulnerability affects your stack