CVE-2010-4555: XSS
Multiple cross-site scripting (XSS) flaws were found in the SquirrelMail webmail client: XSS flaws in generic options inputs, XSS flaw in the SquirrelSpell plug-in, XSS flaw in the Index Order page.
Also protection against Cross-site Request Forgery (CSRF) flaws has been added to the empty trash feature and to the Index Order page.
The CSRF flaws got a dedicated CVE identifier of CVE-2011-2753. For further information have a look at: [1] https://bugzilla.redhat.com/showbug.cgi?id=CVE-2011-2753
Upstream advisory: [2] http://www.squirrelmail.org/security/issue/2011-07-11
Relevant upstream patch: [3] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) drop-down selection lists, (2) the > (greater than) character in the SquirrelSpell spellchecking plugin, and (3) errors associated with the Index Order (aka optionsorder) page.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4555?
CVE-2010-4555 is categorized as a moderate severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2010-4555?
To fix CVE-2010-4555, update SquirrelMail to a version that addresses the identified XSS vulnerabilities, specifically to version 1.4.21 or later.
What types of vulnerabilities does CVE-2010-4555 include?
CVE-2010-4555 includes multiple cross-site scripting (XSS) vulnerabilities found in various inputs across the SquirrelMail client.
What is affected by CVE-2010-4555?
CVE-2010-4555 affects all versions of SquirrelMail up to and including 1.4.20.
Can CVE-2010-4555 be exploited remotely?
Yes, CVE-2010-4555 can be exploited remotely by an attacker through malicious scripts executed in a user's browser.