First published: Tue Dec 31 2002(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in magicHTML of SquirrelMail before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via (1) "<<script" in unspecified input fields or (2) a javascript: URL in the src attribute of an IMG tag.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
SquirrelMail | =1.2.0 | |
SquirrelMail | =1.2.2 | |
SquirrelMail | =1.2.1 | |
SquirrelMail | =1.2.4 | |
SquirrelMail | =1.2.3 | |
SquirrelMail | =1.2.5 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2002-2086 is categorized as a moderate severity vulnerability due to its potential for cross-site scripting attacks.
To fix CVE-2002-2086, upgrade SquirrelMail to version 1.2.6 or later, which addresses these XSS vulnerabilities.
CVE-2002-2086 affects SquirrelMail versions 1.2.0 through 1.2.5.
CVE-2002-2086 allows attackers to perform cross-site scripting (XSS) attacks that can lead to unauthorized actions on behalf of users.
The best workaround for CVE-2002-2086 is to restrict access to the affected SquirrelMail installations until they can be upgraded.