-=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=- ACS Security Assessment Advisory - XSS Scripting Vulnerability ID: ACSSEC-2005-11-25 - 0x3 Class: Cross-Site-Scripting (XSS) Package: FTGate 4.4 [Build 4.4.000 Oct 26 2005] Build: Windows NT/2k/XP/2k3 Notified: Dec 01, 2005 Released: Dec 20, 2005 Remote: Yes Severity: Low Credit: Tim Shelton -=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=- -=[ Background FTGate4 is a powerful Windows(TM) communication suite that combines exceptional mail handling facilities with comprehensive Groupware functionality. Its security and collaboration features were developed in conjunction with leading ISP's and define a new era in mail server performance. -=[ Technical Description FTGate 4.4 [Build 4.4.000 Oct 26 2005] is vulnerable to specially crafted XSS requests. A remote attacker could trick a user into viewing a vulnerable page which could then lead to remote compromise. -=[ Proof of Concepts http://127.0.0.1:8089/index.fts?href=">