CVE-2004-0591
SqWebMail 4.0.4.20040524 - Email Header HTML Injection
Severity Score
6.8
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Cross-site scripting (XSS) vulnerability in the print_header_uc function for SqWebMail 4.0.4 and earlier, and possibly 3.x, allows remote attackers to inject arbitrary web script or HRML via (1) e-mail headers or (2) a message with a "message/delivery-status" MIME Content-Type.
Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función print_header_uc de SqWebMail 4.0.4 y anteriores, y posiblemente 3.x, permite a atacantes remotos inyectar script web arbitrario o HTML mediante (1) cabeceras de correo electrónico o (2) un mensaje con un "message/delivery-status" MIME Content-Type.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2004-06-21 First Exploit
- 2004-06-23 CVE Reserved
- 2004-06-24 CVE Published
- 2023-06-01 EPSS Updated
- 2024-08-08 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://marc.info/?l=bugtraq&m=108786212220140&w=2 | Mailing List | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16467 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/24227 | 2004-06-21 | |
| http://www.securityfocus.com/bid/10588 | 2024-08-08 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/11918 | 2017-07-11 | |
| http://www.debian.org/security/2004/dsa-533 | 2017-07-11 | |
| http://www.gentoo.org/security/en/glsa/glsa-200408-02.xml | 2017-07-11 |
| URL | Date | SRC |
|---|