CVE-2004-0591 Cross-site scripting (XSS) vulnerability in the print_header_uc function for SqWebMail 4.0.4 and earlier, and possibly 3.x, allows remote attackers to inject arbitrary web script or HRML via (1) e-mai...
MediumCVSS 6.8
EPSS 5.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the print_header_uc function for SqWebMail 4.0.4 and earlier, and possibly 3.x, allows remote attackers to inject arbitrary web script or HRML via (1) e-mail headers or (2) a message with a "message/delivery-status" MIME Content-Type.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| inter7 sqwebmail | = 4.0.4 | No fix listed |
| debian/courier(Debian:12) | < 0.45.4-4 | 0.45.4-4 |
| debian/courier(Debian:13) | < 0.45.4-4 | 0.45.4-4 |
| debian/courier(Debian:14) | < 0.45.4-4 | 0.45.4-4 |
References
- Debian Security Tracker CVE-2004-0591 vendor-advisory
- 20040621 XSS vulnerability in Sqwebmail 4.0.4 mailing-list
- 11918 patch third-party-advisory vendor-advisory
- DSA-533 patch vendor-advisory
- GLSA-200408-02 patch vendor-advisory
- 10588 exploit patch vdb-entry
- sqwebmail-print-header-xss(16467) vdb-entry