PT-2009-4066 · Nasmail+2 · Nasmail+2
Christian Balzer
+1
·
Published
2009-05-14
·
Updated
2017-09-29
·
CVE-2009-1578
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
SquirrelMail versions prior to 1.4.18
NaSMail versions prior to 1.7
Description:
The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible through various vectors, including certain encrypted strings in e-mail headers related to contrib/decrypt headers.php, PHP SELF, and the query string.
Recommendations:
For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue.
For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue.
As a temporary workaround, consider restricting access to the contrib/decrypt headers.php module and limiting the use of PHP SELF and query strings in affected API endpoints until a patch is available.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nasmail
Red Hat
Squirrelmail