CVE-2011-2753: CSRF

Q: What is the severity of CVE-2011-2753?

CVE-2011-2753 has a moderate severity rating as it allows cross-site request forgery attacks that can lead to unauthorized actions on behalf of users.

Q: How do I fix CVE-2011-2753?

To fix CVE-2011-2753, users should upgrade to SquirrelMail version 1.4.22 or later.

Q: What types of attacks can exploit CVE-2011-2753?

CVE-2011-2753 can be exploited through cross-site request forgery (CSRF) attacks targeting the empty trash and index order functionalities.

Q: Which versions of SquirrelMail are affected by CVE-2011-2753?

CVE-2011-2753 affects SquirrelMail versions 1.4.21 and earlier, including versions 0.1 through 1.4.20.

Q: What is the potential impact of exploiting CVE-2011-2753?

Exploiting CVE-2011-2753 can lead to unauthorized actions being performed on the account of an unsuspecting user.

Published Jul 17, 2011

Updated

Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka optionsorder) page, a different issue than CVE-2010-4555.

Affected Software

91 affected components

Squirrelmail Squirrelmail=1.3.1

Squirrelmail Squirrelmail=1.4.2

Squirrelmail Squirrelmail=0.4

Squirrelmail Squirrelmail=1.0.6

Squirrelmail Squirrelmail=1.0.5

Squirrelmail Squirrelmail=0.3

Squirrelmail Squirrelmail=0.4pre2

Squirrelmail Squirrelmail=1.4.17

Squirrelmail Squirrelmail=1.2.0-rc3

Squirrelmail Squirrelmail=1.1.0

Squirrelmail Squirrelmail=1.0pre2

Squirrelmail Squirrelmail=0.3.1

Squirrelmail Squirrelmail=1.4.19

Squirrelmail Squirrelmail=1.4.0-r1

Squirrelmail Squirrelmail=0.1.2

Squirrelmail Squirrelmail=1.2.7

Squirrelmail Squirrelmail=1.2.6-rc1

Squirrelmail Squirrelmail=1.4.13

Squirrelmail Squirrelmail=1.0.1

Squirrelmail Squirrelmail=0.2.1

Squirrelmail Squirrelmail=1.4.12

Squirrelmail Squirrelmail=1.4.9a

Squirrelmail Squirrelmail=1.4.6

Squirrelmail Squirrelmail=1.4.3-r3

Squirrelmail Squirrelmail=1.2.0

Squirrelmail Squirrelmail=1.4.7

Squirrelmail Squirrelmail=1.2.9

Squirrelmail Squirrelmail=0.1

Squirrelmail Squirrelmail=1.4.15

Squirrelmail Squirrelmail=1.2.2

Squirrelmail Squirrelmail=0.5pre2

Squirrelmail Squirrelmail=1.4.2-r3

Squirrelmail Squirrelmail=1.1.1

Squirrelmail Squirrelmail=1.4.16

Squirrelmail Squirrelmail=1.4-rc1

Squirrelmail Squirrelmail=1.1.2

Squirrelmail Squirrelmail=1.4.2-r5

Squirrelmail Squirrelmail=1.4.4-rc1

Squirrelmail Squirrelmail=1.4.15rc1

Squirrelmail Squirrelmail=0.3pre2

Squirrelmail Squirrelmail=1.4.3

Squirrelmail Squirrelmail=0.1.1

Squirrelmail Squirrelmail=1.3.2

Squirrelmail Squirrelmail=1.4.3-rc1

Squirrelmail Squirrelmail=1.2.1

Squirrelmail Squirrelmail=1.4.1

Squirrelmail Squirrelmail=1.4.9

Squirrelmail Squirrelmail=1.2

Squirrelmail Squirrelmail=1.4.20

Squirrelmail Squirrelmail=1.4.8

Squirrelmail Squirrelmail=1.4.6_cvs

Squirrelmail Squirrelmail=1.4.0

Squirrelmail Squirrelmail=1.4.0-rc1

Squirrelmail Squirrelmail=1.4

Squirrelmail Squirrelmail=1.1.3

Squirrelmail Squirrelmail=1.4.0-rc2a

Squirrelmail Squirrelmail=1.2.4

Squirrelmail Squirrelmail=0.5pre1

Squirrelmail Squirrelmail=1.4.5-rc1

Squirrelmail Squirrelmail=1.2.3

Squirrelmail Squirrelmail=1.4.10

Squirrelmail Squirrelmail=1.4.3a

Squirrelmail Squirrelmail=1.4.2-r1

Squirrelmail Squirrelmail=1.0.2

Squirrelmail Squirrelmail=1.0.4

Squirrelmail Squirrelmail=1.4.6-rc1

Squirrelmail Squirrelmail=1.0pre1

Squirrelmail Squirrelmail=1.2.6

Squirrelmail Squirrelmail=1.4.15-rc1

Squirrelmail Squirrelmail=1.4.2-r2

Squirrelmail Squirrelmail=1.4.8.4fc6

Squirrelmail Squirrelmail=1.4.10a

Squirrelmail Squirrelmail=1.4.4

Squirrelmail Squirrelmail=1.4.2-r4

Squirrelmail Squirrelmail=1.4.18

Squirrelmail Squirrelmail=1.4.3aa

Squirrelmail Squirrelmail=0.3pre1

Squirrelmail Squirrelmail=1.2.10

Squirrelmail Squirrelmail<=1.4.21

Squirrelmail Squirrelmail=0.4pre1

Squirrelmail Squirrelmail=1.2.5

Squirrelmail Squirrelmail=1.4.11

Squirrelmail Squirrelmail=1.0.3

Squirrelmail Squirrelmail=1.3.0

Squirrelmail Squirrelmail=1.0

Squirrelmail Squirrelmail=0.2

Squirrelmail Squirrelmail=1.2.8

Squirrelmail Squirrelmail=1.2.11

Squirrelmail Squirrelmail=0.5

Squirrelmail Squirrelmail=1.4.5

Squirrelmail Squirrelmail=1.0pre3

Remediation

Patch Available

http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119

Patch Available

https://bugzilla.redhat.com/show_bug.cgi?id=720694

Event History

Jul 17, 2011

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-2753?

CVE-2011-2753 has a moderate severity rating as it allows cross-site request forgery attacks that can lead to unauthorized actions on behalf of users.

How do I fix CVE-2011-2753?

To fix CVE-2011-2753, users should upgrade to SquirrelMail version 1.4.22 or later.

What types of attacks can exploit CVE-2011-2753?

CVE-2011-2753 can be exploited through cross-site request forgery (CSRF) attacks targeting the empty trash and index order functionalities.

Which versions of SquirrelMail are affected by CVE-2011-2753?

CVE-2011-2753 affects SquirrelMail versions 1.4.21 and earlier, including versions 0.1 through 1.4.20.

What is the potential impact of exploiting CVE-2011-2753?

Exploiting CVE-2011-2753 can lead to unauthorized actions being performed on the account of an unsuspecting user.

CVE-2011-2753: CSRF

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2011-2753?

How do I fix CVE-2011-2753?

What types of attacks can exploit CVE-2011-2753?

Which versions of SquirrelMail are affected by CVE-2011-2753?

What is the potential impact of exploiting CVE-2011-2753?

Company

Resources

Contact