PT-2004-1731 · Squirrelmail · Squirrelmail

Publicado 2004-07-09 · Atualizado 2017-07-11 · CVE-2004-0639

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Squirrelmail versions 1.2.10 and earlier

Description The issue allows remote attackers to inject arbitrary HTML or script via several vectors, including the mailer variable in read body.php, the senderNames part variable in mailbox display.php, and possibly other vectors such as the event title variable or the event text variable.

Recommendations For Squirrelmail versions 1.2.10 and earlier, as a temporary workaround, consider restricting access to the read body.php and mailbox display.php scripts until a patch is available. Avoid using the mailer and senderNames part variables in these scripts until the issue is resolved. Additionally, restrict the use of the event title and event text variables if they are confirmed to be vulnerable.

Exploit

Correção

Identificadores relacionados

CVE-2004-0639

DSA-535

Produtos afetados

Squirrelmail

Referências · 10

• 🔥 http://securityfocus.com/bid/10450 · Exploit
• 🔥 https://exploit-db.com/exploits/24167 · Exploit
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=257973 · Nota
• http://rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=108611554415078&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16285 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0639 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0639 · Nota
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000858 · Aviso do Fabricante
• http://debian.org/security/2004/dsa-535 · Aviso do Fabricante