CVE-2004-0520: XSS
Published Jun 3, 2004
·Updated
Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using readbody.php.
Affected Software
21 affected components
Open Webmail Open WebMail=2.30
Open Webmail Open WebMail=2.31
Open Webmail Open WebMail=2.32
SGI ProPack=3.0
Squirrelmail Squirrelmail=1.2.0
Squirrelmail Squirrelmail=1.2.1
Squirrelmail Squirrelmail=1.2.2
Squirrelmail Squirrelmail=1.2.3
Squirrelmail Squirrelmail=1.2.4
Squirrelmail Squirrelmail=1.2.5
Squirrelmail Squirrelmail=1.2.6
Squirrelmail Squirrelmail=1.2.7
Squirrelmail Squirrelmail=1.2.8
Squirrelmail Squirrelmail=1.2.9
Squirrelmail Squirrelmail=1.2.10
Squirrelmail Squirrelmail=1.2.11
Squirrelmail Squirrelmail=1.4
Squirrelmail Squirrelmail=1.4.1
Squirrelmail Squirrelmail=1.4.2
Squirrelmail Squirrelmail=1.4.3_rc1
Squirrelmail Squirrelmail=1.5_dev
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Jun 3, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0520?
CVE-2004-0520 is considered to be a medium severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2004-0520?
To fix CVE-2004-0520, upgrade to SquirrelMail version 1.4.3 or later where the issue has been resolved.
3
Which versions of SquirrelMail are affected by CVE-2004-0520?
CVE-2004-0520 affects SquirrelMail versions prior to 1.4.3, including all versions from 1.2.0 to 1.4.2.
4
Can CVE-2004-0520 be exploited remotely?
Yes, CVE-2004-0520 can be exploited remotely by attackers through specially crafted content-type mail headers.
5
Is there a workaround for CVE-2004-0520 if I can't upgrade?
Disabling the processing of content-type mail headers can serve as a temporary workaround for CVE-2004-0520.