CVE-2002-2086: XSS
Multiple cross-site scripting (XSS) vulnerabilities in magicHTML of SquirrelMail before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via (1) "<<script" in unspecified input fields or (2) a javascript: URL in the src attribute of an IMG tag.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2002-2086?
CVE-2002-2086 is categorized as a moderate severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2002-2086?
To fix CVE-2002-2086, upgrade SquirrelMail to version 1.2.6 or later, which addresses these XSS vulnerabilities.
Which versions of SquirrelMail are affected by CVE-2002-2086?
CVE-2002-2086 affects SquirrelMail versions 1.2.0 through 1.2.5.
What types of attacks are possible due to CVE-2002-2086?
CVE-2002-2086 allows attackers to perform cross-site scripting (XSS) attacks that can lead to unauthorized actions on behalf of users.
Are there any workarounds for CVE-2002-2086?
The best workaround for CVE-2002-2086 is to restrict access to the affected SquirrelMail installations until they can be upgraded.