PT-2020-14069 · Squirrelmail · Squirrelmail

Hanno Böck · Published 2020-06-20 · Updated 2020-06-26 · CVE-2020-14932

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SquirrelMail version 1.4.22

Description The issue arises from the compose.php file in SquirrelMail, which calls unserialize for the $mailtodata value. This value originates from an HTTP GET request, making it a potential entry point for exploitation. The vulnerability is related to the mailto.php file.

Recommendations For SquirrelMail version 1.4.22, consider disabling the unserialize function for the $mailtodata value in the compose.php file as a temporary workaround until a patch is available. Restrict access to the compose.php and mailto.php files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-14932

Affected Products

Squirrelmail

References · 7

• https://ubuntu.com/security/CVE-2020-14932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14932 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-14932 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14932 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14932 · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/06/20/1 · Note
• https://t.me/cvenotify/4538 · Telegram Post