CVE-2005-1308: High severity inter7 vpopmail (vchkpw) vulnerability
Published Apr 15, 2005
·Updated
SqWebMail allows remote attackers to inject arbitrary web script or HTML via CRLF sequences in the redirect parameter followed by the desired script or HTML.
Affected Software
9 affected components
Inter7 SqWebMail=3.5.0
Inter7 SqWebMail=4.0.4_2004-05-24
Inter7 SqWebMail=3.4.1
Inter7 SqWebMail=3.6.0
Inter7 SqWebMail=3.6.1
Inter7 SqWebMail=3.5.3
Inter7 SqWebMail=3.5.2
Inter7 SqWebMail=3.5.1
Inter7 SqWebMail=4.0.5
Event History
Apr 15, 2005
CVE Published
04:00 AM
Apr 27, 2005
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-1308?
CVE-2005-1308 is considered a critical vulnerability due to its potential for remote code execution via script injection.
2
How do I fix CVE-2005-1308?
To fix CVE-2005-1308, upgrade to a patched version of SqWebMail that removes the vulnerability.
3
Which versions of SqWebMail are affected by CVE-2005-1308?
CVE-2005-1308 affects SqWebMail versions 3.4.1, 3.5.1 through 3.5.3, 3.6.0, 3.6.1, and 4.0.4_2004-05-24, as well as 4.0.5.
4
What is the type of attack possible with CVE-2005-1308?
CVE-2005-1308 allows attackers to perform Cross-Site Scripting (XSS) attacks by injecting arbitrary web script or HTML.
5
What kind of parameter is exploited in CVE-2005-1308?
CVE-2005-1308 exploits the 'redirect' parameter by allowing CRLF sequences to inject code.