REDHAT-BUG-500363: XSS

Published May 12, 2009

Updated

A, From SquirrelMail vulnerability report (http://www.squirrelmail.org/security/issue/2009-05-08):

Two issues were fixed that both allowed an attacker to run arbitrary script (XSS) on most any SquirrelMail page by getting the user to click on specially crafted SquirrelMail links.

Credits: Niels Teusink and Christian Balzer

Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13670

B, From SquirrelMail vulnerability report: (http://www.squirrelmail.org/security/issue/2009-05-09):

An issue was fixed wherein input to the contrib/decryptheaders.php script was not sanitized and allowed arbitrary script execution upon submission of certain values.

Credits: Niels Teusink

Patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13672

Affected Software

1 affected component

Squirrelmail Squirrelmail

Event History

May 12, 2009

Data Sourced

12:49 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-500363?

The severity of REDHAT-BUG-500363 is considered high due to the potential for cross-site scripting (XSS) attacks.

How do I fix REDHAT-BUG-500363?

To fix REDHAT-BUG-500363, ensure that you are using the latest version of SquirrelMail that addresses these vulnerabilities.

What vulnerability type is associated with REDHAT-BUG-500363?

REDHAT-BUG-500363 is associated with a cross-site scripting (XSS) vulnerability.

Which software is affected by REDHAT-BUG-500363?

SquirrelMail is the affected software in REDHAT-BUG-500363.

What attacks can REDHAT-BUG-500363 enable?

REDHAT-BUG-500363 can enable attackers to execute arbitrary scripts on SquirrelMail pages.