CVE-2004-0639

SquirrelMail 1.2.x - From Email Header HTML Injection

Severity Score

6.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable.

Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados en Squirrelmail 1.2.10 y anteriores permiten a atacantes remotos inyectar HTML o script de su elección mediante (1) la variable $mailer en read_body.php, (2) la variable $senderNames_part en mailbox_display.php, y posiblemente otros vectores,incluyendo (3) la variable $event_text.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2004-06-03 First Exploit
2004-07-08 CVE Reserved
2004-07-09 CVE Published
2024-08-08 CVE Updated
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (8)

URL	Tag	Source
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=257973	X_refsource_confirm
http://marc.info/?l=bugtraq&m=108611554415078&w=2	Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/16285	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/24167	2004-06-03
http://www.securityfocus.com/bid/10450	2024-08-08

URL	Date	SRC
http://www.debian.org/security/2004/dsa-535	2017-07-11

URL	Date	SRC
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000858	2017-07-11
http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt	2017-07-11

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Open Webmail Search vendor "Open Webmail"		Open Webmail Search vendor "Open Webmail" for product "Open Webmail"				2.30 Search vendor "Open Webmail" for product "Open Webmail" and version "2.30"		-		Affected
Open Webmail Search vendor "Open Webmail"		Open Webmail Search vendor "Open Webmail" for product "Open Webmail"				2.31 Search vendor "Open Webmail" for product "Open Webmail" and version "2.31"		-		Affected
Open Webmail Search vendor "Open Webmail"		Open Webmail Search vendor "Open Webmail" for product "Open Webmail"				2.32 Search vendor "Open Webmail" for product "Open Webmail" and version "2.32"		-		Affected
Sgi Search vendor "Sgi"		Propack Search vendor "Sgi" for product "Propack"				3.0 Search vendor "Sgi" for product "Propack" and version "3.0"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.0 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.0"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.1 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.1"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.2 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.2"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.3 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.3"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.4 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.4"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.5 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.5"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.6 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.6"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.7 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.7"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.8 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.8"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.9 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.9"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.10 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.10"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.2.11 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.2.11"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.1 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.1"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.2 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.2"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.3_rc1 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.3_rc1"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.5_dev Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.5_dev"		-		Affected