PT-2002-2232 · Squirrelmail · Squirrelmail

Publicado 2002-11-14 · Atualizado 2008-09-05 · CVE-2002-1276

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SquirrelMail version 1.2.8

Description: The issue is related to an incomplete fix for a cross-site scripting (XSS) vulnerability. This vulnerability occurs because the strip tags function is called on the PHP SELF value, but the result is not saved back to that variable, making it susceptible to cross-site scripting attacks.

Recommendations: For SquirrelMail version 1.2.8, ensure that the result of the strip tags function is saved back to the PHP SELF variable to prevent cross-site scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-1276

DSA-191

Produtos afetados

Squirrelmail

Referências · 8

• http://redhat.com/support/errata/RHSA-2003-042.html · Aviso do Fabricante
• http://iss.net/security_center/static/10634.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1276 · Nota de Segurança
• http://securityfocus.com/bid/7019 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1276 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=167471 · Aviso do Fabricante
• http://debian.org/security/2002/dsa-191 · Aviso do Fabricante
• http://secunia.com/advisories/8220 · Nota