Debian DSA-2091-1 : squirrelmail - No user-specific token implemented

SquirrelMail, a webmail application, does not employ a user-specific token for webforms. This allows a remote attacker to perform a Cross Site Request Forgery CSRF attack. The attacker may hijack the authentication of unspecified victims and send messages or change user preferences among other...