CVE-2009-2964 Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via fe...
MediumCVSS 6.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squirrelmail | <= 1.4.19 | No fix listed |
| squirrelmail | = 0.1.1 | No fix listed |
| squirrelmail | = 0.1.2 | No fix listed |
| squirrelmail | = 1.0 | No fix listed |
| squirrelmail | = 1.0.1 | No fix listed |
| squirrelmail | = 1.0.2 | No fix listed |
| squirrelmail | = 1.0.3 | No fix listed |
| squirrelmail | = 1.0.4 | No fix listed |
| squirrelmail | = 1.0.5 | No fix listed |
| squirrelmail | = 1.0.6 | No fix listed |
| squirrelmail | = 1.0pre1 | No fix listed |
| squirrelmail | = 1.0pre2 | No fix listed |
| squirrelmail | = 1.0pre3 | No fix listed |
| squirrelmail | = 1.1.0 | No fix listed |
| squirrelmail | = 1.1.1 | No fix listed |
| squirrelmail | = 1.1.2 | No fix listed |
| squirrelmail | = 1.1.3 | No fix listed |
| squirrelmail | = 1.2 | No fix listed |
| squirrelmail | = 1.2.0 | No fix listed |
| squirrelmail | = 1.2.0-rc3 | No fix listed |
| squirrelmail | = 1.2.0_rc3 | No fix listed |
| squirrelmail | = 1.2.1 | No fix listed |
| squirrelmail | = 1.2.2 | No fix listed |
| squirrelmail | = 1.2.3 | No fix listed |
| squirrelmail | = 1.2.4 | No fix listed |
Show 61 more
| Product | Affected versions | Fixed in |
|---|---|---|
| squirrelmail | = 1.2.5 | No fix listed |
| squirrelmail | = 1.2.6 | No fix listed |
| squirrelmail | = 1.2.6-rc1 | No fix listed |
| squirrelmail | = 1.2.7 | No fix listed |
| squirrelmail | = 1.2.8 | No fix listed |
| squirrelmail | = 1.2.9 | No fix listed |
| squirrelmail | = 1.2.10 | No fix listed |
| squirrelmail | = 1.2.11 | No fix listed |
| squirrelmail | = 1.3.0 | No fix listed |
| squirrelmail | = 1.3.1 | No fix listed |
| squirrelmail | = 1.3.2 | No fix listed |
| squirrelmail | = 1.4 | No fix listed |
| squirrelmail | = 1.4-rc1 | No fix listed |
| squirrelmail | = 1.4.0 | No fix listed |
| squirrelmail | = 1.4.0-rc1 | No fix listed |
| squirrelmail | = 1.4.0-rc2a | No fix listed |
| squirrelmail | = 1.4.0-r1 | No fix listed |
| squirrelmail | = 1.4.0_rc1 | No fix listed |
| squirrelmail | = 1.4.0_rc2a | No fix listed |
| squirrelmail | = 1.4.1 | No fix listed |
| squirrelmail | = 1.4.2 | No fix listed |
| squirrelmail | = 1.4.2-r1 | No fix listed |
| squirrelmail | = 1.4.2-r2 | No fix listed |
| squirrelmail | = 1.4.2-r3 | No fix listed |
| squirrelmail | = 1.4.2-r4 | No fix listed |
| squirrelmail | = 1.4.2-r5 | No fix listed |
| squirrelmail | = 1.4.3 | No fix listed |
| squirrelmail | = 1.4.3-r3 | No fix listed |
| squirrelmail | = 1.4.3-rc1 | No fix listed |
| squirrelmail | = 1.4.3_r3 | No fix listed |
| squirrelmail | = 1.4.3_rc1 | No fix listed |
| squirrelmail | = 1.4.3_rc1-r1 | No fix listed |
| squirrelmail | = 1.4.3a | No fix listed |
| squirrelmail | = 1.4.3aa | No fix listed |
| squirrelmail | = 1.4.4 | No fix listed |
| squirrelmail | = 1.4.4-rc1 | No fix listed |
| squirrelmail | = 1.4.4_rc1 | No fix listed |
| squirrelmail | = 1.4.5 | No fix listed |
| squirrelmail | = 1.4.5_rc1 | No fix listed |
| squirrelmail | = 1.4.6 | No fix listed |
| squirrelmail | = 1.4.6-rc1 | No fix listed |
| squirrelmail | = 1.4.6_cvs | No fix listed |
| squirrelmail | = 1.4.6_rc1 | No fix listed |
| squirrelmail | = 1.4.7 | No fix listed |
| squirrelmail | = 1.4.8 | No fix listed |
| squirrelmail | = 1.4.8.4fc6 | No fix listed |
| squirrelmail | = 1.4.9 | No fix listed |
| squirrelmail | = 1.4.9a | No fix listed |
| squirrelmail | = 1.4.10 | No fix listed |
| squirrelmail | = 1.4.10a | No fix listed |
| squirrelmail | = 1.4.11 | No fix listed |
| squirrelmail | = 1.4.12 | No fix listed |
| squirrelmail | = 1.4.13 | No fix listed |
| squirrelmail | = 1.4.15 | No fix listed |
| squirrelmail | = 1.4.15-rc1 | No fix listed |
| squirrelmail | = 1.4.15_rc1 | No fix listed |
| squirrelmail | = 1.4.15rc1 | No fix listed |
| squirrelmail | = 1.4.16 | No fix listed |
| squirrelmail | = 1.4.17 | No fix listed |
| squirrelmail | = 1.4.18 | No fix listed |
| squirrelmail | = 1.4_rc1 | No fix listed |
References
- bugs.debian.org
- download.gna.org
- JVN#30881447 third-party-advisory
- JVNDB-2009-002207 third-party-advisory
- APPLE-SA-2010-06-15-1 vendor-advisory
- 60469 vdb-entry
- 34627 third-party-advisory vendor-advisory
- 36363 third-party-advisory vendor-advisory
- 37415 third-party-advisory
- 40220 third-party-advisory
- 40964 third-party-advisory
- squirrelmail.svn.sourceforge.net patch
- squirrelmail.svn.sourceforge.net patch
- support.apple.com
- DSA-2091 vendor-advisory
- MDVSA-2009:222 vendor-advisory
- 57001 vdb-entry
- 36196 vdb-entry
- www.squirrelmail.org patch vendor-advisory
- ADV-2009-2262 patch vdb-entry vendor-advisory
- ADV-2009-3315 vdb-entry
- ADV-2010-1481 vdb-entry
- ADV-2010-2080 vdb-entry
- bugzilla.redhat.com patch
- squirrelmail-unspecified-csrf(52406) vdb-entry
- gna.org
- oval:org.mitre.oval:def:10668 signature vdb-entry
- FEDORA-2009-8797 vendor-advisory
- FEDORA-2009-8822 vendor-advisory