PT-2020-14070 · Squirrelmail · Squirrelmail

Hanno Böck · Published 2020-06-20 · Updated 2024-08-04 · CVE-2020-14933

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SquirrelMail version 1.4.22

Description The issue arises in compose.php, where the $attachments value from an HTTP POST request is passed to unserialize. This could potentially lead to PHP object injection. However, the vendor disputes this, citing that two necessary conditions for such an injection are not met: the existence of a PHP magic method like wakeup or destruct, and the declaration or autoloading of attack-relevant classes before unserialize is called.

Recommendations For SquirrelMail version 1.4.22, consider disabling the unserialize function for the $attachments value in compose.php as a temporary workaround until a patch is available. Restrict access to the compose.php module to minimize the risk of exploitation. Avoid using user-inputted data in the $attachments value until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-14933

Affected Products

Squirrelmail

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-14933 · Security Note
• https://ubuntu.com/security/CVE-2020-14933 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14933 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14933 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-14933 · Security Note
• https://openwall.com/lists/oss-security/2020/06/20/1 · Note
• https://t.me/cvenotify/88979 · Telegram Post
• https://t.me/cvenotify/4539 · Telegram Post