CVE-2009-0030
6.1 Medium
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
76.2%
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users’ folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
| CPE | Name | Operator | Version |
|---|---|---|---|
| squirrelmail:squirrelmail | squirrelmail | eq | 1.4.8 |
References
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
secunia.com/advisories/33611
securitytracker.com/id?1021611
www.securityfocus.com/bid/33354
bugzilla.redhat.com/show_bug.cgi?id=480224
bugzilla.redhat.com/show_bug.cgi?id=480488
exchange.xforce.ibmcloud.com/vulnerabilities/48115
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10366
rhn.redhat.com/errata/RHSA-2009-0057.html
Related
6.1 Medium
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
76.2%