Lucene search

Japan Vulnerability NotesJVN:30881447

HistoryJan 07, 2011 - 12:00 a.m.

JVN#30881447: SquirrelMail vulnerable to cross-site request forgery

2011-01-0700:00:00

Japan Vulnerability Notes

jvn.jp

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.004

Percentile

73.7%

JSON

SquirrelMail from SquirrelMail Project is an open source webmail (web-based email).
SquirrelMail contains an issue in processing of sending a message or setting changes, which may result in cross-site request forgery.

Impact

A remote attacker may send an arbitrary email or change the settings.

Solution

Update the Software
Update to the latest version of SquirrelMail according to the information provided by the developer.

The issue was resolved in SquirrelMail 1.4.20.

Products Affected

SquirrelMail 1.4.19 and earlier

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.004

Percentile

73.7%

JSON

Related for JVN:30881447