CVE-2011-2023: XSS
An cross-site scripting (XSS) flaw was found in the way SquirrelMail performed sanitization of MIME messages containing certain <style> HTML tags. A remote attacker could provide a specially-crafted message, which once opened in SquirrelMail webmail client could lead to arbitrary JavaScript or HTML code execution.
Upstream advisory: [1] http://www.squirrelmail.org/security/issue/2011-07-10
Relevant patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14121
Other sources
Cross-site scripting (XSS) vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via a crafted STYLE element in an e-mail message.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2023?
CVE-2011-2023 has a moderate severity rating due to the potential for remote attackers to execute arbitrary JavaScript via crafted MIME messages.
How do I fix CVE-2011-2023?
To fix CVE-2011-2023, upgrade SquirrelMail to version 1.4.21 or later, which addresses the vulnerability.
What versions of SquirrelMail are affected by CVE-2011-2023?
CVE-2011-2023 affects all versions of SquirrelMail prior to 1.4.21, including several versions starting from 0.1 to 1.4.20.
Can CVE-2011-2023 lead to data theft?
Yes, CVE-2011-2023 can potentially lead to data theft as an attacker may execute malicious scripts to access sensitive information.
Is there a workaround for CVE-2011-2023 if I cannot upgrade?
A temporary workaround for CVE-2011-2023 is to disable MIME handling in SquirrelMail until an upgrade can be performed.