PT-2009-4066 · Nasmail+2 · Nasmail+2

Christian Balzer

+1

·

Published

2009-05-14

·

Updated

2017-09-29

·

CVE-2009-1578

CVSS v2.0

4.3

Medium

VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.4.18 NaSMail versions prior to 1.7
Description: The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible through various vectors, including certain encrypted strings in e-mail headers related to contrib/decrypt headers.php, PHP SELF, and the query string.
Recommendations: For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the contrib/decrypt headers.php module and limiting the use of PHP SELF and query strings in affected API endpoints until a patch is available.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2009-1578
DSA-1802-1
RHSA-2009:1066
RHSA-2009_1066

Affected Products

Nasmail
Red Hat
Squirrelmail