CVE-2004-0639: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in readbody.php, (2) the $senderNamespart variable in mailboxdisplay.php, and possibly other vectors including (3) the $eventtitle variable or (4) the $eventtext variable.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-0639?
CVE-2004-0639 is rated as a moderate risk vulnerability, allowing attackers to execute arbitrary scripts in the context of a user's session.
How do I fix CVE-2004-0639?
To fix CVE-2004-0639, upgrade to SquirrelMail version 1.2.11 or later where the vulnerability has been patched.
What systems are affected by CVE-2004-0639?
CVE-2004-0639 affects SquirrelMail versions 1.2.10 and earlier, among other versions of Open Webmail and SGI ProPack.
What types of attacks can be carried out due to CVE-2004-0639?
CVE-2004-0639 enables attackers to perform cross-site scripting (XSS) attacks by injecting arbitrary HTML or scripts.
Is CVE-2004-0639 easy to exploit?
Yes, CVE-2004-0639 can be easily exploited if users visit malicious web pages that utilize the vulnerabilities in SquirrelMail.