CVE-2005-2095: XSS
optionsidentities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $POST variable, which allows remote attackers to modify or read the preferences of other users, conduct cross-site scripting XSS) attacks, and write arbitrary files.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-2095?
CVE-2005-2095 is considered a high severity vulnerability due to its potential for unauthorized access and data manipulation.
How do I fix CVE-2005-2095?
To fix CVE-2005-2095, upgrade to a version of SquirrelMail later than 1.4.4 that addresses this vulnerability.
What types of attacks can CVE-2005-2095 facilitate?
CVE-2005-2095 can facilitate unauthorized preference access, cross-site scripting (XSS) attacks, and arbitrary file writing.
Which versions of SquirrelMail are affected by CVE-2005-2095?
CVE-2005-2095 affects SquirrelMail versions 1.4.4 and earlier.
How is CVE-2005-2095 exploited by attackers?
Attackers exploit CVE-2005-2095 by leveraging the vulnerable extract function in options_identities.php to manipulate user preferences.