PT-2002-2374 · Squirrelmail · Squirrelmail

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-1650

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SquirrelMail versions prior to 1.2.3

Description The issue allows remote attackers to execute arbitrary commands. This is achieved by modifying the sqspell command parameter in the spell checker plugin, which is check me.mod.php.

Recommendations For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the spell checker plugin to minimize the risk of exploitation. Avoid using the modified sqspell command parameter in the affected plugin until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2002-1650

Produtos afetados

Squirrelmail

Referências · 5

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-01/0296.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1650 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2002-01/0306.html · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7990 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1650 · Nota de Segurança