title: Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting
description: The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: MAIL2000
vendor: Openfind
versions:
lessThan: Before 20190919, status: affected, version: 6.0, versionType: custom
lessThan: SP4 Patch 076, status: affected, version: 7.0, versionType: custom
}