CVE-2004-2447: Cross-site scripting (XSS) vulnerability in 1st Class Mail Server 4.01 allows remote attackers to inject ar...

Security readout for executives and security teams

This is a legacy webmail cross-site scripting issue in 1st Class Mail Server 4.01. An attacker could cause browser-executed script or HTML to be reflected through the Mailbox parameter on several webmail pages. Business risk depends on whether this old product is still exposed to users or the internet. Likely exposure is limited to organizations still operating 1st Class Mail Server 4.01 with the affected webmail routes reachable by browsers. Internet exposure increases risk, but the bundle does not confirm how common deployments are today. Prioritize discovery over emergency response unless the product is exposed. If 1st Class Mail Server 4.01 is internet-facing or used by privileged staff, isolate it and plan replacement because the evidence does not identify a current supported fix. Mitigation focus: Identify whether 1st Class Mail Server 4.01 is still deployed.; Check vendor or maintainer guidance for patches, replacements, or retirement advice.; Restrict access to affected webmail routes while exposure is assessed..

Prepared

Jun 29, 2026, 18:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.