CVE-2002-0516 SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie.
HighCVSS 10.0
EPSS 11.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squirrelmail | = 1.2.0 | No fix listed |
| squirrelmail | = 1.2.1 | No fix listed |
| squirrelmail | = 1.2.2 | No fix listed |
| squirrelmail | = 1.2.3 | No fix listed |
| squirrelmail | = 1.2.4 | No fix listed |
| squirrelmail | = 1.2.5 | No fix listed |
References
- 20020327 squirrelmail 1.2.5 email user can execute command mailing-list
- 20020331 Re: squirrelmail 1.2.5 email user can execute command mailing-list
- squirrelmail-theme-command-execution(8671) patch vdb-entry vendor-advisory
- 4385 exploit patch vdb-entry vendor-advisory