CVE-2009-0030
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
7.3 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
76.4%
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users’ folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
Affected configurations
References
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
secunia.com/advisories/33611
securitytracker.com/id?1021611
www.securityfocus.com/bid/33354
bugzilla.redhat.com/show_bug.cgi?id=480224
bugzilla.redhat.com/show_bug.cgi?id=480488
exchange.xforce.ibmcloud.com/vulnerabilities/48115
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10366
rhn.redhat.com/errata/RHSA-2009-0057.html
Related
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
7.3 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
76.4%