PT-2007-3908 · Squirrelmail+1 · Squirrelmail+1

Publicado 2007-05-11 · Atualizado 2017-10-11 · CVE-2007-2589

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SquirrelMail versions 1.4.0 through 1.4.9a

Description A cross-site request forgery issue exists, allowing remote attackers to send emails from arbitrary users by manipulating certain data in the SRC attribute of an IMG element in compose.php.

Recommendations For SquirrelMail versions 1.4.0 through 1.4.9a, consider disabling the compose.php functionality until a patch is available to prevent exploitation of this issue. Restrict access to the affected compose.php module to minimize the risk of unauthorized email sending.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2007-2589

DSA-1290-1

RHSA-2007:0358

RHSA-2007_0358

Produtos afetados

Red Hat

Squirrelmail

Referências · 21

• http://squirrelmail.org/security/issue/2007-05-09 · Nota
• http://vupen.com/english/advisories/2007/2732 · Nota
• http://securityfocus.com/bid/25159 · Nota
• http://osvdb.org/35889 · Nota
• http://secunia.com/advisories/26235 · Nota
• http://secunia.com/advisories/25320 · Nota
• http://docs.info.apple.com/article.html?artnum=306172 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11448 · Nota
• http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html · Aviso do Fabricante
• http://novell.com/linux/security/advisories/2007_13_sr.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2007-2589 · Nota
• https://rhn.redhat.com/errata/RHSA-2007-0358.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1748 · Nota
• http://secunia.com/advisories/25787 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2007:106 · Aviso do Fabricante