PT-2009-4066 · Nasmail+2 · Nasmail+2
Christian Balzer
+1
·
Publicado
2009-05-14
·
Atualizado
2017-09-29
·
CVE-2009-1578
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
SquirrelMail versions prior to 1.4.18
NaSMail versions prior to 1.7
Description:
The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible through various vectors, including certain encrypted strings in e-mail headers related to contrib/decrypt headers.php, PHP SELF, and the query string.
Recommendations:
For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue.
For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue.
As a temporary workaround, consider restricting access to the contrib/decrypt headers.php module and limiting the use of PHP SELF and query strings in affected API endpoints until a patch is available.
Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Nasmail
Red Hat
Squirrelmail