CVE-2017-16962 - CVE House
Back to Database
Status published Medium CVE-2017-16962

The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro...

Vulnerability Description

The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-16962

Credits & Attribution

No credits recorded in the NVD database.

References

More from communigate

View All →
CVE-2018-18621
CommuniGate Pro 6.2 allows stored XSS via a message body...
Medium 6.1
CVE-2006-0566
The LDAP component in CommuniGate Pro Core Server 5.0.7 allows...
Medium 5

Affected Vendor

communigate

View all reports →

Affected Software

communigate pro
Vulnerable Versions:
0

Timeline

Official Publish: November 27th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.