PT-2002-2232 · Squirrelmail · Squirrelmail

Published 2002-11-14 · Updated 2008-09-05 · CVE-2002-1276

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SquirrelMail version 1.2.8

Description: The issue is related to an incomplete fix for a cross-site scripting (XSS) vulnerability. This vulnerability occurs because the strip tags function is called on the PHP SELF value, but the result is not saved back to that variable, making it susceptible to cross-site scripting attacks.

Recommendations: For SquirrelMail version 1.2.8, ensure that the result of the strip tags function is saved back to the PHP SELF variable to prevent cross-site scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-1276

DSA-191

Affected Products

Squirrelmail

References · 8

• http://redhat.com/support/errata/RHSA-2003-042.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1276 · Security Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=167471 · Vendor Advisory
• http://debian.org/security/2002/dsa-191 · Vendor Advisory
• http://iss.net/security_center/static/10634.php · Note
• http://securityfocus.com/bid/7019 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1276 · Note
• http://secunia.com/advisories/8220 · Note