CVE-2005-1769: XSS

Published Jun 16, 2005

Updated

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in (1) the URL or (2) an e-mail message.

Affected Software

6 affected components

Squirrelmail Squirrelmail=1.4.2

Squirrelmail Squirrelmail=1.4.3_rc1

Squirrelmail Squirrelmail=1.4.3

Squirrelmail Squirrelmail=1.4.1

Squirrelmail Squirrelmail=1.44

Squirrelmail Squirrelmail=1.4.3a

Remediation

Patch Available

http://www.squirrelmail.org/security/issue/2005-06-15

Event History

Jun 16, 2005

CVE Published

04:00 AM

Jun 20, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-1769?

CVE-2005-1769 is classified as a moderate severity vulnerability due to the potential for cross-site scripting attacks.

How do I fix CVE-2005-1769?

To fix CVE-2005-1769, upgrade SquirrelMail to version 1.4.5 or later that addresses the cross-site scripting vulnerabilities.

Which versions of SquirrelMail are affected by CVE-2005-1769?

CVE-2005-1769 affects SquirrelMail versions 1.4.0 through 1.4.4.

What types of attacks can be executed through CVE-2005-1769?

CVE-2005-1769 allows remote attackers to inject arbitrary web script or HTML into vulnerable SquirrelMail installations.

Is there a workaround for CVE-2005-1769 if I cannot upgrade?

While upgrading is the best option, sanitizing user inputs can help mitigate the risks associated with CVE-2005-1769.