CVE-2006-6142: XSS

Published Dec 5, 2006

Updated

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) deletedraft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."

Affected Software

15 affected components

Squirrelmail Squirrelmail=1.4.2

Squirrelmail Squirrelmail=1.4.6_rc1

Squirrelmail Squirrelmail=1.4.3_r3

Squirrelmail Squirrelmail=1.4.6

Squirrelmail Squirrelmail=1.4.7

Squirrelmail Squirrelmail=1.4.3_rc1

Squirrelmail Squirrelmail=1.4.4_rc1

Squirrelmail Squirrelmail=1.4.3

Squirrelmail Squirrelmail=1.4.1

Squirrelmail Squirrelmail=1.4.6_cvs

Squirrelmail Squirrelmail=1.4

Squirrelmail Squirrelmail=1.4_rc1

Squirrelmail Squirrelmail=1.4.4

Squirrelmail Squirrelmail=1.4.3aa

Squirrelmail Squirrelmail=1.4.5

Event History

Dec 5, 2006

CVE Published

11:28 AM

Data Sourced

via NVD·11:28 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-6142?

CVE-2006-6142 is classified as a moderate severity vulnerability due to the potential for cross-site scripting attacks.

How do I fix CVE-2006-6142?

To fix CVE-2006-6142, upgrade to SquirrelMail version 1.4.10 or later where the vulnerabilities have been addressed.

What versions of SquirrelMail are affected by CVE-2006-6142?

CVE-2006-6142 affects SquirrelMail versions 1.4.0 through 1.4.9.

What types of attacks can be executed due to CVE-2006-6142?

The vulnerabilities in CVE-2006-6142 can allow remote attackers to inject arbitrary web script or HTML into the application.

Is there any workaround for CVE-2006-6142?

There are no official workarounds for CVE-2006-6142; upgrading to a secure version is recommended.