REDHAT-BUG-517312: CSRF
It was reported that SquirrelMail did not implement protections against cross-site request forgery (CSRF) attacks. This can be exploited to e.g. change user preferences, delete emails, and potentially send emails when a logged-in user visits a malicious web page.
Upstream advisory: http://www.squirrelmail.org/security/issue/2009-08-12
Upstream patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818
Issue was first addressed in 1.4.20RC1.
Secunia advisory: http://secunia.com/advisories/34627/
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-517312?
The severity of REDHAT-BUG-517312 is classified as high due to its potential for CSRF attacks.
How do I fix REDHAT-BUG-517312?
To fix REDHAT-BUG-517312, upgrade to the latest version of SquirrelMail that contains CSRF protections.
What vulnerabilities does REDHAT-BUG-517312 expose SquirrelMail to?
REDHAT-BUG-517312 exposes SquirrelMail to cross-site request forgery (CSRF) attacks that can manipulate user settings and actions.
Which versions of SquirrelMail are affected by REDHAT-BUG-517312?
Versions of SquirrelMail prior to 1.4.20RC1 are affected by REDHAT-BUG-517312.
What types of actions can be exploited due to REDHAT-BUG-517312?
Due to REDHAT-BUG-517312, an attacker can exploit the vulnerability to change user preferences, delete emails, and send emails.