« Volver al listado

CVE-2022-27105

Estado: ModificadaMedia (5.4)—

InMailX Outlook Plugin < 3.22.0101 is vulnerable to Cross Site Scripting (XSS). InMailX Connection names are not sanitzed in the Outlook tab, which allows a local user or network administrator to execute HTML / Javascript in the Outlook of users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Digitus — Inmailx

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-27105",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-26T22:15:10.753",
  "references": [
    {
      "url": "http://www.inmailx.com/products/inmailx",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://gist.github.com/0xVavaldi/9b7afbfe56938294480f7613805d3b7f",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.inmailx.com/products/inmailx",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://gist.github.com/TheWorkingDeveloper/9b7afbfe56938294480f7613805d3b7f",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "InMailX Outlook Plugin < 3.22.0101 is vulnerable to Cross Site Scripting (XSS). InMailX Connection names are not sanitzed in the Outlook tab, which allows a local user or network administrator to execute HTML / Javascript in the Outlook of users."
    },
    {
      "lang": "es",
      "value": "El plugin de InMailX para Outlook versiones anteriores a 3.22.0101, es vulnerable a un ataque de tipo Cross Site Scripting (XSS). Los nombres de conexión de InMailX no están saneados en la pestaña de Outlook, lo que permite a un usuario local o administrador de red ejecutar HTML / Javascript en el Outlook de los usuarios."
    }
  ],
  "lastModified": "2026-06-17T04:36:21.963",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:digitus:inmailx:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3D40381-1CF8-4094-8AF9-4135E2075F4C",
              "versionEndExcluding": "3.22.0101",
              "versionStartIncluding": "3.21.0601"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}