Veracode Vulnerability DatabaseVERACODE:23881Cross-site Scripting (XSS)
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
squirrelmail is vulnerable to cross-site scripting (XSS). The vulnerability exists as an attacker could construct a carefully crafted URL, which once visited by an unsuspecting user, could cause the user’s web browser to execute malicious script in the context of the visited SquirrelMail web page.
References
download.gna.org/nasmail/nasmail-1.7.zip
lists.apple.com/archives/security-announce/2010//Jun/msg00001.html
osvdb.org/60468
secunia.com/advisories/35052
secunia.com/advisories/35073
secunia.com/advisories/35140
secunia.com/advisories/35259
secunia.com/advisories/37415
secunia.com/advisories/40220
squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/contrib/decrypt_headers.php?r1=13672&r2=13671&pathrev=13672
squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog
squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/global.php?r1=13670&r2=13669&pathrev=13670
squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670
squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672
support.apple.com/kb/HT4188
www.debian.org/security/2009/dsa-1802
www.mandriva.com/security/advisories?name=MDVSA-2009:110
www.redhat.com/security/updates/classification/#important
www.redhat.com/support/errata/RHSA-2009-1066.html
www.securityfocus.com/bid/34916
www.squirrelmail.org/security/issue/2009-05-08
www.squirrelmail.org/security/issue/2009-05-09
www.squirrelmail.org/security/issue/2009-05-10
www.squirrelmail.org/security/issue/2009-05-12
www.vupen.com/english/advisories/2009/1296
www.vupen.com/english/advisories/2009/3315
www.vupen.com/english/advisories/2010/1481
access.redhat.com/errata/RHSA-2009:1066
bugzilla.redhat.com/show_bug.cgi?id=500363
exchange.xforce.ibmcloud.com/vulnerabilities/50459
exchange.xforce.ibmcloud.com/vulnerabilities/50460
gna.org/forum/forum.php?forum_id=2146
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11624
www.redhat.com/archives/fedora-package-announce/2009-May/msg00566.html
www.redhat.com/archives/fedora-package-announce/2009-May/msg00572.html
www.redhat.com/archives/fedora-package-announce/2009-May/msg00577.html
Related
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N