PT-2007-3908 · Squirrelmail+1 · Squirrelmail+1

Published 2007-05-11 · Updated 2017-10-11 · CVE-2007-2589

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SquirrelMail versions 1.4.0 through 1.4.9a

Description A cross-site request forgery issue exists, allowing remote attackers to send emails from arbitrary users by manipulating certain data in the SRC attribute of an IMG element in compose.php.

Recommendations For SquirrelMail versions 1.4.0 through 1.4.9a, consider disabling the compose.php functionality until a patch is available to prevent exploitation of this issue. Restrict access to the affected compose.php module to minimize the risk of unauthorized email sending.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2007-2589

DSA-1290-1

RHSA-2007:0358

RHSA-2007_0358

Affected Products

Red Hat

Squirrelmail

References · 21

• http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_13_sr.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2007-0358.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:106 · Vendor Advisory
• http://secunia.com/advisories/25200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2589 · Security Note
• http://squirrelmail.org/security/issue/2007-05-09 · Note
• http://vupen.com/english/advisories/2007/2732 · Note
• http://securityfocus.com/bid/25159 · Note
• http://osvdb.org/35889 · Note
• http://secunia.com/advisories/26235 · Note
• http://secunia.com/advisories/25320 · Note
• http://docs.info.apple.com/article.html?artnum=306172 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11448 · Note
• https://access.redhat.com/security/cve/CVE-2007-2589 · Note