REDHAT-BUG-720694: XSS

Published Jul 12, 2011

Updated

Multiple cross-site scripting (XSS) flaws were found in the SquirrelMail webmail client: XSS flaws in generic options inputs, XSS flaw in the SquirrelSpell plug-in, XSS flaw in the Index Order page.

Also protection against Cross-site Request Forgery (CSRF) flaws has been added to the empty trash feature and to the Index Order page.

The CSRF flaws got a dedicated CVE identifier of CVE-2011-2753. For further information have a look at: [1] https://bugzilla.redhat.com/showbug.cgi?id=CVE-2011-2753

Upstream advisory: [2] http://www.squirrelmail.org/security/issue/2011-07-11

Relevant upstream patch: [3] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119

Affected Software

1 affected component

Squirrelmail Squirrelmail

Event History

Jul 12, 2011

Data Sourced

via Red Hat·02:19 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-720694?

The severity of REDHAT-BUG-720694 is classified as critical due to multiple cross-site scripting vulnerabilities.

How do I fix REDHAT-BUG-720694?

To fix REDHAT-BUG-720694, update your SquirrelMail to the latest version that contains the patches for the identified vulnerabilities.

What are the main vulnerabilities in REDHAT-BUG-720694?

The main vulnerabilities in REDHAT-BUG-720694 include multiple cross-site scripting (XSS) flaws and previously unprotected cross-site request forgery (CSRF) issues.

Which versions of SquirrelMail are affected by REDHAT-BUG-720694?

REDHAT-BUG-720694 affects multiple versions of SquirrelMail that do not have the necessary security updates applied.

Is there a known exploit for REDHAT-BUG-720694?

Yes, there are known exploits for the cross-site scripting vulnerabilities detailed in REDHAT-BUG-720694.