CVE-2006-3665: XSS

Published Jul 17, 2006

Updated

SquirrelMail 1.4.6 and earlier, with registerglobals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this.

Affected Software

1 affected component

Squirrelmail Squirrelmail=1.4.6

Event History

Jul 17, 2006

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3665?

CVE-2006-3665 is considered a medium severity vulnerability due to its potential for cookie hijacking.

How do I fix CVE-2006-3665?

To fix CVE-2006-3665, disable register_globals in your PHP configuration and consider updating to a newer version of SquirrelMail.

What versions are affected by CVE-2006-3665?

CVE-2006-3665 affects SquirrelMail version 1.4.6 and earlier.

Can CVE-2006-3665 lead to remote code execution?

CVE-2006-3665 does not directly lead to remote code execution, but it can allow attackers to hijack cookies.

Is there a workaround for CVE-2006-3665?

The primary workaround for CVE-2006-3665 is to disable register_globals and implement secure coding practices.