PT-2022-19563

CVE-2022-29360

Published

2022-04-22

Updated

2023-05-28

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RainLoop versions through 1.6.0

Description The issue allows for XSS via a crafted email message in the Email Viewer. This can potentially be exploited to steal users' emails.

Recommendations For versions through 1.6.0, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting the use of the Email Viewer until a patch is available. Avoid using the Email Viewer with crafted email messages until the issue is resolved.

Exploitability

Exploit

Fix

Impacts

Researchers

Simon Scannell

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2022-29360