CVE-2019-15071 json
Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting
published 2019-11-20 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-6151
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities.
Patch / fix
- Openfind MAIL2000 Before 20190919, SP4 Patch 076
Exploit prediction
1.63% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- Openfind MAIL2000
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
openfind.com.tw
/taiwan/resource.html
product, vendor-advisory
-
gist.github.com
/tonykuo76/95638395e0c83e68dbd3db0fa0184e27
third-party-advisory
-
gist.github.com
/chtsecurity/21119b393640bea1d010ab9e3bee216d
third-party-advisory
-
chtsecurity.com
/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt
third-party-advisory
-
twcert.org.tw
/en/cp-128-3085-45bda-2.html
third-party-advisory
-
tvn.twcert.org.tw
/taiwanvn/TVN-201909001
third-party-advisory
- openfind.com.tw /taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf
- openfind.com.tw /taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf
Sources
- CVE List CVE-2019-15071
- NVD CVE-2019-15071
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.