TI-2002-00715 Aliases CVE-2002-0738 GHSA-mqj3-hp36-pg28

MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail…

LOW 38Published 2003-04-02 · Updated 2024-08-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients by (1) splitting the SCRIPT tag into smaller pieces, (2) including the script in a SRC argument to an IMG tag, or (3) using "&={script}" syntax.

Why it matters now

EPSS 0.02515 84th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:mhonarc:mhonarc:2.5:::::::*	2.5	Vulnerable	Mhonarc
cpe:2.3:a:mhonarc:mhonarc:2.5.1:::::::*	2.5.1	Vulnerable	Mhonarc
cpe:2.3:a:mhonarc:mhonarc:2.5.2:::::::*	2.5.2	Vulnerable	Mhonarc

cpe:2.3:a:mhonarc:mhonarc:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Mhonarc
cpe:2.3:a:mhonarc:mhonarc:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Mhonarc
cpe:2.3:a:mhonarc:mhonarc:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Mhonarc

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2002-0738
2026-10-03 Alias added: GHSA-mqj3-hp36-pg28

References

Patch 1

mhonarc-script-filtering-bypass(8894)

Advisory 2

Other 1

20020418 MHonArc v2.5.2 Script Filtering Bypass Vulnerability

TI-2002-01242 Cross-site scripting vulnerability (XSS) in MHonArc 2.5.12 and earlier allows remote… CVSS 2.0MEDIUM 6.8
TI-2010-01619 MHonArc 2.6.16 allows remote attackers to cause a denial of service (CPU consumption) via… CVSS 2.0MEDIUM 5.0
TI-2010-04254 Cross-site scripting (XSS) vulnerability in lib/mhtxthtml.pl in MHonArc 2.6.16 allows… CVSS 2.0MEDIUM 4.3
TI-2002-01311 Cross-site scripting (XSS) vulnerability in MHonArc before 2.5.14 allows remote attackers… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences