CVE-2008-3663: Medium severity squirrelmail vulnerability
Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Reference: BUGTRAQ:20080922 Squirrelmail: Session hijacking vulnerability, CVE-2008-3663 Reference: URL:http://www.securityfocus.com/archive/1/archive/1/496601/100/0/threaded Reference: MISC:http://int21.de/cve/CVE-2008-3663-squirrelmail.html Reference: BID:31321 Reference: URL:http://www.securityfocus.com/bid/31321
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3663?
CVE-2008-3663 is classified as a moderate severity vulnerability due to the potential for session hijacking.
How do I fix CVE-2008-3663?
To fix CVE-2008-3663, upgrade SquirrelMail to a version later than 1.4.15 that addresses the session cookie security issue.
Which versions of SquirrelMail are affected by CVE-2008-3663?
SquirrelMail version 1.4.15 is specifically affected by CVE-2008-3663, while earlier versions may also be prone to similar issues.
What impact does CVE-2008-3663 have on secure communications?
CVE-2008-3663 allows session cookies to be sent over unsecured HTTP connections, increasing the risk of interception by attackers.
Is there a patch available for CVE-2008-3663?
Yes, users can apply the patch by upgrading to a non-vulnerable version of SquirrelMail provided by the software maintainers.