We tested on the current RELENG_3 and HEAD branches and IMP was 
filtering out this code correctly. That means that IMP 3.2.3 is safe 
too, as safe as active filtering can be.

Suggested priority: 3. High

I've changed the priority due to what could be done if IMP is 
vulnerable. The list includes:



Theft of login and password.

Content disclosure of any email in the mailbox.

Automatically send emails from the mailbox.

Exploitation of known vulnerabilities in the browser to access the 
user's file system and eventually take over the machine.

Distribution of a web-based email worm.

Disclosure of all contacts within the address book.

I just realized that the verison we are using IMP 3.2.2.



Brian

Is IMP vulnerable to this exploit: Remotely Exploitable Cross-Site Scripting



More information is available here: 
http://www.greymagic.com/security/advisories/gm005-mc/



Brian Loftus