description: Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially force an administrator to click on a malicious link to perform unauthorized actions.
problem types: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
affected:
{
vendor: Kaspersky
product: Kaspersky Security for Linux Mail Server 8
versions:
version: *, status: affected, lessThan: 8.0.3.30 Security Patch A, versionType: custom
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
]
solutions: Install version 8.0.3.30 Security Patch A of Kaspersky Security 8.0 for Linux Mail Server.