CVE-2006-0377

🗓️ 24 Feb 2006 00:00:02Reported by mitreType

cve🔗 web.nvd.nist.gov👁 80 Views🌐 WEB

CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP..

5 of 5AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 28
Packet Storm	SquirrelFlaws.txt	2 Mar 200600:00	–	packetstorm
NVD	CVE-2006-0377	24 Feb 200600:02	–	nvd
Prion	Crlf injection	24 Feb 200600:02	–	prion
UbuntuCve	CVE-2006-0377	24 Feb 200600:00	–	ubuntucve
Cvelist	CVE-2006-0377	24 Feb 200600:00	–	cvelist
securityvulns	[ISecAuditors Advisories] IMAP/SMTP Injection in SquirrelMail	28 Feb 200600:00	–	securityvulns
securityvulns	[ MDKSA-2006:049 ] - Updated squirrelmail packages fix vulnerabilities	28 Feb 200600:00	–	securityvulns
Debian	[SECURITY] [DSA 988-1] New squirrelmail packages fix several vulnerabilities	8 Mar 200616:42	–	debian
Debian	[SECURITY] [DSA 988-1] New squirrelmail packages fix several vulnerabilities	8 Mar 200616:42	–	debian
Tenable Nessus	FreeBSD : squirrelmail -- multiple vulnerabilities (af9018b6-a4f5-11da-bb41-0011433a9404)	13 May 200600:00	–	nessus

Nvd

Node

squirrelmail squirrelmailMatch1.4

squirrelmail squirrelmailMatch1.4.1

squirrelmail squirrelmailMatch1.4.2

squirrelmail squirrelmailMatch1.4.3

squirrelmail squirrelmailMatch1.4.3_r3

squirrelmail squirrelmailMatch1.4.3_rc1

squirrelmail squirrelmailMatch1.4.3a

squirrelmail squirrelmailMatch1.4.4

squirrelmail squirrelmailMatch1.4.4_rc1

squirrelmail squirrelmailMatch1.4.5

squirrelmail squirrelmailMatch1.4.6_rc1

squirrelmail squirrelmailMatch1.4_rc1

Source	Link
patches	www.patches.sgi.com/support/free/security/advisories/20060501-01-U.asc
secunia	www.secunia.com/advisories/19960
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/24849
vupen	www.vupen.com/english/advisories/2006/0689
secunia	www.secunia.com/advisories/19130
secunia	www.secunia.com/advisories/19205
oval	www.oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11470
secunia	www.secunia.com/advisories/18985
mandriva	www.mandriva.com/security/advisories
debian	www.debian.org/security/2006/dsa-988

Parameter	Position	Path	Description	CWE
mailbox	query param	/src/read_body.php	The 'mailbox' parameter in the GET request can be exploited to inject arbitrary IMAP commands.	CWE-20, CWE-86
subject	binary	/src/compose.php	The 'subject' parameter in the POST request can be manipulated to inject SMTP commands.	CWE-20, CWE-86

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

24 Feb 2006 00:02Current

6.8Medium risk

Vulners AI Score6.8

CVSS25

EPSS0.01608