CVE-2004-0639 Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the....
MediumCVSS 6.8
EPSS 6.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| open webmail | = 2.30 | No fix listed |
| open webmail | = 2.31 | No fix listed |
| open webmail | = 2.32 | No fix listed |
| sgi propack | = 3.0 | No fix listed |
| squirrelmail | = 1.2.0 | No fix listed |
| squirrelmail | = 1.2.1 | No fix listed |
| squirrelmail | = 1.2.2 | No fix listed |
| squirrelmail | = 1.2.3 | No fix listed |
| squirrelmail | = 1.2.4 | No fix listed |
| squirrelmail | = 1.2.5 | No fix listed |
| squirrelmail | = 1.2.6 | No fix listed |
| squirrelmail | = 1.2.7 | No fix listed |
| squirrelmail | = 1.2.8 | No fix listed |
| squirrelmail | = 1.2.9 | No fix listed |
| squirrelmail | = 1.2.10 | No fix listed |
| squirrelmail | = 1.2.11 | No fix listed |
| squirrelmail | = 1.4 | No fix listed |
| squirrelmail | = 1.4.1 | No fix listed |
| squirrelmail | = 1.4.2 | No fix listed |
| squirrelmail | = 1.4.3_rc1 | No fix listed |
| squirrelmail | = 1.5_dev | No fix listed |
References
- bugs.debian.org
- CLA-2004:858 vendor-advisory
- 20040530 RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability mailing-list
- DSA-535 patch vendor-advisory
- www.rs-labs.com vendor-advisory
- 10450 exploit patch vdb-entry
- squirrelmail-from-header-xss(16285) vdb-entry