Vulnerability in Open Webmail
CVE-2004-0639
Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable.
EPSS: 0.060 (92.5th percentile) — read the EPSS interpretation.
Affected products
- Open_webmail — versions 2.30, 2.31, 2.32
- Sgi Propack — versions 3.0
- Squirrelmail — versions 1.2.0, 1.2.1, 1.2.2
- N/a — versions n/a
References
- cve@mitre.org (x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vendor-advisory, Patch, x_refsource_DEBIAN, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vendor-advisory, x_refsource_CONECTIVA)
- cve@mitre.org (Exploit, Patch, vdb-entry, x_refsource_BID)