PT-2002-2374 · Squirrelmail · Squirrelmail

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1650

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SquirrelMail versions prior to 1.2.3

Description The issue allows remote attackers to execute arbitrary commands. This is achieved by modifying the sqspell command parameter in the spell checker plugin, which is check me.mod.php.

Recommendations For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the spell checker plugin to minimize the risk of exploitation. Avoid using the modified sqspell command parameter in the affected plugin until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2002-1650

Affected Products

Squirrelmail

References · 5

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-01/0296.html · Exploit
• http://archives.neohapsis.com/archives/bugtraq/2002-01/0306.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2002-1650 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1650 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7990 · Note