PT-2002-2806 · Squirrelmail · Squirrelmail

Publicado

2002-12-31

·

Atualizado

2017-07-11

·

CVE-2002-2086

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.2.6
Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the magicHTML component of SquirrelMail. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved through two methods: (1) by inserting "<<script" in unspecified input fields, or (2) by using a javascript: URL in the src attribute of an IMG tag.
Recommendations: For versions prior to 1.2.6, update to version 1.2.6 or later to resolve the issue. As a temporary workaround, consider restricting user input in fields that may be used to inject malicious scripts, and avoid using javascript: URLs in the src attribute of IMG tags until the update is applied.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2002-2086

Produtos afetados

Squirrelmail