PT-2009-4069 · Squirrelmail+1 · Squirrelmail+1

Luc Beurton

·

Publicado

2009-05-14

·

Atualizado

2017-09-29

·

CVE-2009-1581

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.4.18
Description: The issue allows remote attackers to spoof the user interface and conduct cross-site scripting (XSS) and phishing attacks via a crafted HTML e-mail message. This is due to the application's content not being protected from Cascading Style Sheets (CSS) positioning in HTML e-mail messages.
Recommendations: For versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. As a temporary workaround, consider restricting the use of HTML e-mail messages until the update is applied.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-1581
DSA-1802-1
RHSA-2009:1066
RHSA-2009_1066

Produtos afetados

Red Hat
Squirrelmail