« Volver al listado

CVE-2012-3536

Estado: ModificadaMedia (6.1)—

Se han solucionado dos vulnerabilidades de Cross-Site Scripting (XSS) en la lista y vista de mensaje en la aplicación Hupa Webmail del proyecto Apache James. Un atacante podría enviar un email cuidadosamente manipulado a un usuario de Hupa, que desencadenaría un Cross-Site Scripting (XSS) cuando el email se abriese o cuando se visualizase una lista de mensajes. Este problema se ha abordado en Hupa 0.0.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Hupa

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-3536",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Hupa",
          "versions": [
            {
              "status": "affected",
              "version": "Hupa versions prior to 0.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-02-27T19:29:00.280",
  "references": [
    {
      "url": "http://svn.apache.org/viewvc?view=revision&revision=1373762",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://james.apache.org/hupa/index.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://svn.apache.org/viewvc?view=revision&revision=1373762",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://james.apache.org/hupa/index.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of messages were viewed. This issue was addressed in Hupa 0.0.3."
    },
    {
      "lang": "es",
      "value": "Se han solucionado dos vulnerabilidades de Cross-Site Scripting (XSS) en la lista y vista de mensaje en la aplicación Hupa Webmail del proyecto Apache James. Un atacante podría enviar un email cuidadosamente manipulado a un usuario de Hupa, que desencadenaría un Cross-Site Scripting (XSS) cuando el email se abriese o cuando se visualizase una lista de mensajes. Este problema se ha abordado en Hupa 0.0.3."
    }
  ],
  "lastModified": "2026-06-16T23:43:25.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:hupa:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "457E0F4F-5999-4A85-8016-52BD2B9B8A1E",
              "versionEndExcluding": "0.0.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}