CVE-2007-1262

XSS through HTML message in squirrelmail

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.

Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en el filtro de HTML en el SquirrelMail 1.4.0 hasta la 1.4.9a permiten a atacantes remotos la inyección de secuencias de comandos web o HTML de su elección mediante (1) datos: un URI en un adjunto de un correo electrónico en HTML o (2) mediante varios juegos de caracteres no-ASCII que no son filtrados adecuadamente cuando son visualizados por el Microsoft Internet Explorer.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-03-03 CVE Reserved
2007-05-11 CVE Published
2024-07-06 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (26)

URL	Tag	Source
http://docs.info.apple.com/article.html?artnum=306172	X_refsource_confirm
http://jvn.jp/en/jp/JVN09157962/index.html	Third Party Advisory
http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000398.html	Third Party Advisory
http://osvdb.org/35887	Vdb Entry
http://osvdb.org/35888	Vdb Entry
http://secunia.com/advisories/25236	Third Party Advisory
http://secunia.com/advisories/25320	Third Party Advisory
http://secunia.com/advisories/25690	Third Party Advisory
http://secunia.com/advisories/25787	Third Party Advisory
http://secunia.com/advisories/26235	Third Party Advisory
http://www.securityfocus.com/bid/23910	Vdb Entry
http://www.securityfocus.com/bid/25159	Vdb Entry
http://www.securitytracker.com/id?1018033	Vdb Entry
http://www.squirrelmail.org/security/issue/2007-05-09	X_refsource_confirm
http://www.vupen.com/english/advisories/2007/1748	Vdb Entry
http://www.vupen.com/english/advisories/2007/2732	Vdb Entry
https://issues.rpath.com/browse/RPL-1353	X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11712	Signature

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/25200	2017-10-11

URL	Date	SRC
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html	2017-10-11
http://www.debian.org/security/2007/dsa-1290	2017-10-11
http://www.mandriva.com/security/advisories?name=MDKSA-2007:106	2017-10-11
http://www.novell.com/linux/security/advisories/2007_13_sr.html	2017-10-11
https://rhn.redhat.com/errata/RHSA-2007-0358.html	2017-10-11
https://access.redhat.com/security/cve/CVE-2007-1262	2007-05-17
https://bugzilla.redhat.com/show_bug.cgi?id=239647	2007-05-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.0 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.0"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.1 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.1"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.2 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.2"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.3 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.3"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.3_r3 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.3_r3"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.3_rc1 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.3_rc1"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.3a Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.3a"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.3aa Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.3aa"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.4 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.4"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.4_rc1 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.4_rc1"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.5 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.5"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.6 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.6"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.6_cvs Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.6_cvs"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.6_rc1 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.6_rc1"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.7 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.7"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.8 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.8"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.9 Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.9"		-		Affected
Squirrelmail Search vendor "Squirrelmail"		Squirrelmail Search vendor "Squirrelmail" for product "Squirrelmail"				1.4.9a Search vendor "Squirrelmail" for product "Squirrelmail" and version "1.4.9a"		-		Affected