PT-2009-2743 · Squirrelmail+1 · Squirrelmail+1

Tomas Hoger · Published 2009-01-19 · Updated 2023-02-13 · CVE-2009-0030

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SquirrelMail version 1.4.8

Description The issue allows remote authenticated users to access other users' folder lists and configuration data under certain circumstances by using the standard webmail.php interface. This occurs because a Red Hat patch for SquirrelMail sets the same SQMSESSID cookie value for all sessions.

Recommendations For SquirrelMail version 1.4.8, consider disabling the use of the SQMSESSID cookie until a proper fix is applied to prevent unauthorized access to user data. Restrict access to the webmail.php interface to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-0030

RHSA-2009:0057

RHSA-2009_0057

Affected Products

Red Hat

Squirrelmail

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2009-0030 · Security Note
• https://rhn.redhat.com/errata/RHSA-2009-0057.html · Vendor Advisory
• http://secunia.com/advisories/33611 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2009-0030 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=480488 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0030 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10366 · Note
• https://access.redhat.com/security/cve/CVE-2009-1580 · Note
• http://securitytracker.com/id?1021611 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=480224 · Note
• https://access.redhat.com/errata/RHSA-2009:0057 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48115 · Note
• http://securityfocus.com/bid/33354 · Note