CVE-2010-1637: SSRF
Published Jun 22, 2010
·Updated
The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.
Affected Software
98 affected components
Squirrelmail Squirrelmail=1.3.1
Squirrelmail Squirrelmail=1.4.2
Squirrelmail Squirrelmail=0.4
Squirrelmail Squirrelmail=1.0.6
Squirrelmail Squirrelmail=1.0.5
Squirrelmail Squirrelmail=0.3
Squirrelmail Squirrelmail=0.4pre2
Squirrelmail Squirrelmail=1.4.17
Squirrelmail Squirrelmail=1.2.0-rc3
Squirrelmail Squirrelmail=1.1.0
Squirrelmail Squirrelmail=1.0pre2
Squirrelmail Squirrelmail=0.3.1
Squirrelmail Squirrelmail=1.4.19
Squirrelmail Squirrelmail=1.4.0-r1
Squirrelmail Squirrelmail=0.1.2
Squirrelmail Squirrelmail=1.2.7
Squirrelmail Squirrelmail=1.2.6-rc1
Squirrelmail Squirrelmail=1.4.13
Squirrelmail Squirrelmail=1.0.1
Squirrelmail Squirrelmail=0.2.1
Squirrelmail Squirrelmail=1.4.12
Squirrelmail Squirrelmail=1.4.9a
Squirrelmail Squirrelmail=1.4.6
Squirrelmail Squirrelmail=1.4.3-r3
Squirrelmail Squirrelmail=1.2.0
Squirrelmail Squirrelmail=1.4.7
Squirrelmail Squirrelmail=1.2.9
Squirrelmail Squirrelmail=0.1
Squirrelmail Squirrelmail=1.4.15
Squirrelmail Squirrelmail=1.2.2
Squirrelmail Squirrelmail=0.5pre2
Squirrelmail Squirrelmail=1.4.2-r3
Squirrelmail Squirrelmail=1.1.1
Squirrelmail Squirrelmail=1.4.4_rc1
Squirrelmail Squirrelmail=1.4.16
Squirrelmail Squirrelmail=1.4-rc1
Squirrelmail Squirrelmail=1.1.2
Squirrelmail Squirrelmail=1.4.2-r5
Squirrelmail Squirrelmail=1.4.4-rc1
Squirrelmail Squirrelmail=0.3pre2
Squirrelmail Squirrelmail=1.4.3
Squirrelmail Squirrelmail=0.1.1
Squirrelmail Squirrelmail=1.3.2
Squirrelmail Squirrelmail=1.4.3-rc1
Squirrelmail Squirrelmail=1.2.1
Squirrelmail Squirrelmail=1.4.1
Squirrelmail Squirrelmail=1.4.9
Squirrelmail Squirrelmail=1.2
Squirrelmail Squirrelmail=1.4.8
Squirrelmail Squirrelmail=1.4.0
Squirrelmail Squirrelmail=1.4.0-rc1
Squirrelmail Squirrelmail=1.4
Squirrelmail Squirrelmail=1.1.3
Squirrelmail Squirrelmail=1.4.0-rc2a
Squirrelmail Squirrelmail=1.44
Squirrelmail Squirrelmail=1.2.4
Squirrelmail Squirrelmail=0.5pre1
Squirrelmail Squirrelmail=1.4.5-rc1
Squirrelmail Squirrelmail=1.2.3
Squirrelmail Squirrelmail=1.4.10
Squirrelmail Squirrelmail=1.4.3a
Squirrelmail Squirrelmail=1.4.2-r1
Squirrelmail Squirrelmail=1.0.2
Squirrelmail Squirrelmail=1.0.4
Squirrelmail Squirrelmail=1.4.6-rc1
Squirrelmail Squirrelmail=1.0pre1
Squirrelmail Squirrelmail=1.2.6
Squirrelmail Squirrelmail=1.4.15-rc1
Squirrelmail Squirrelmail=1.4.2-r2
Squirrelmail Squirrelmail=1.4.8.4fc6
Squirrelmail Squirrelmail=1.4.10a
Squirrelmail Squirrelmail=1.4.4
Squirrelmail Squirrelmail=1.4.2-r4
Squirrelmail Squirrelmail=1.4.18
Squirrelmail Squirrelmail=1.4.3aa
Squirrelmail Squirrelmail=0.3pre1
Squirrelmail Squirrelmail=1.2.10
Squirrelmail Squirrelmail=0.4pre1
Squirrelmail Squirrelmail=1.2.5
Squirrelmail Squirrelmail<=1.4.20
Squirrelmail Squirrelmail=1.4.11
Squirrelmail Squirrelmail=1.0.3
Squirrelmail Squirrelmail=1.3.0
Squirrelmail Squirrelmail=1.0
Squirrelmail Squirrelmail=0.2
Squirrelmail Squirrelmail=1.2.8
Squirrelmail Squirrelmail=1.2.11
Squirrelmail Squirrelmail=0.5
Squirrelmail Squirrelmail=1.4.5
Squirrelmail Squirrelmail=1.0pre3
Fedoraproject Fedora=11
Fedoraproject Fedora=12
Fedoraproject Fedora=13
Apple iOS and macOS<10.6.8
Apple Mac OS X Server<10.6.8
redhat Enterprise Linux Desktop=5.0
redhat Enterprise Linux Server=5.0
redhat Enterprise Linux Workstation=5.0
Remediation
Patch Available
Patch Available
Event History
Jun 22, 2010
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-1637?
The severity of CVE-2010-1637 is classified as high, due to its potential to allow unauthorized access to internal networks.
2
How do I fix CVE-2010-1637?
To fix CVE-2010-1637, upgrade SquirrelMail to version 1.4.21 or later, which addresses this vulnerability.
3
What does CVE-2010-1637 allow an attacker to do?
CVE-2010-1637 allows remote authenticated users to bypass firewall restrictions and scan internal networks through SquirrelMail.
4
Which versions of SquirrelMail are affected by CVE-2010-1637?
CVE-2010-1637 affects SquirrelMail versions 1.4.20 and earlier.
5
Is CVE-2010-1637 a remote code execution vulnerability?
No, CVE-2010-1637 is not a remote code execution vulnerability but rather allows network scanning via a proxy.