PT-2011-1604 · Squirrelmail+1 · Squirrelspell+2
Jan Lieskovsky
·
Published
2011-07-14
·
Updated
2017-08-17
·
CVE-2010-4555
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
SquirrelMail versions 1.4.21 and earlier
Description
The issue involves multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can occur through various vectors, including drop-down selection lists, the use of the > (greater than) character in the SquirrelSpell spellchecking plugin, and errors related to the Index Order (also known as options order) page.
Recommendations
For SquirrelMail versions 1.4.21 and earlier, update to a version later than 1.4.21 to resolve the issue.
As a temporary workaround, consider disabling the SquirrelSpell spellchecking plugin until a patch is available.
Restrict access to the Index Order page to minimize the risk of exploitation.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Hat
Squirrelmail
Squirrelspell