Veracode Vulnerability DatabaseVERACODE:24830Cross-site Request Fogery (CSRF)
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
squirrelmail is vulnerable to cross-site request forgery (CSRF). The vulnerability exists as it was found that the SquirrelMail Empty Trash and Index Order pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into SquirrelMail, into visiting a specially-crafted URL, the attacker could empty the victim’s trash folder or alter the ordering of the columns on the message index page.
References
rhn.redhat.com/errata/RHSA-2012-0103.html
squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119
www.debian.org/security/2011/dsa-2291
www.mandriva.com/security/advisories?name=MDVSA-2011:123
www.squirrelmail.org/security/issue/2010-06-21
www.squirrelmail.org/security/issue/2010-07-23
www.squirrelmail.org/security/issue/2011-07-10
www.squirrelmail.org/security/issue/2011-07-11
www.squirrelmail.org/security/issue/2011-07-12
access.redhat.com/errata/RHSA-2012:0103
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=720694
exchange.xforce.ibmcloud.com/vulnerabilities/68586
Related
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P