CVE-2009-1581: XSS
From Squirrelmail vulnerability report:
An issue was fixed that allowed phishing and cross-site scripting (XSS) attacks to be run by surreptitious placement of content in specially-crafted emails sent to SquirrelMail users.
Credits: Luc Beurton
Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13667
Other sources
functions/mime.php in SquirrelMail before 1.4.18 does not protect the application's content from Cascading Style Sheets (CSS) positioning in HTML e-mail messages, which allows remote attackers to spoof the user interface, and conduct cross-site scripting (XSS) and phishing attacks, via a crafted message.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1581?
CVE-2009-1581 has a moderate severity rating due to its potential for phishing and cross-site scripting attacks.
How do I fix CVE-2009-1581?
To fix CVE-2009-1581, update your SquirrelMail to the latest version that addresses this vulnerability.
Which versions of SquirrelMail are affected by CVE-2009-1581?
CVE-2009-1581 affects multiple versions of SquirrelMail, including 1.3.1, 1.0.6, and several earlier versions.
Can CVE-2009-1581 lead to data breaches?
Yes, CVE-2009-1581 can potentially lead to data breaches through phishing attacks facilitated by cross-site scripting.
Is there a patch available for CVE-2009-1581?
Yes, patches are available as part of newer SquirrelMail releases that resolve the issues associated with CVE-2009-1581.