PT-2011-1604 · Squirrelmail+1 · Squirrelspell+2
Jan Lieskovsky
·
Publicado
2011-07-14
·
Atualizado
2017-08-17
·
CVE-2010-4555
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
SquirrelMail versions 1.4.21 and earlier
Description
The issue involves multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can occur through various vectors, including drop-down selection lists, the use of the > (greater than) character in the SquirrelSpell spellchecking plugin, and errors related to the Index Order (also known as options order) page.
Recommendations
For SquirrelMail versions 1.4.21 and earlier, update to a version later than 1.4.21 to resolve the issue.
As a temporary workaround, consider disabling the SquirrelSpell spellchecking plugin until a patch is available.
Restrict access to the Index Order page to minimize the risk of exploitation.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Squirrelmail
Squirrelspell