Vulnerability in Squirrelmail

CVE-2005-2095

options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable, which allows remote attackers to modify or read the preferences of other users, conduct cross-site scripting XSS) attacks, and write arbitrary files.

EPSS: 0.042 (90.0th percentile) — read the EPSS interpretation.

Affected products

  • Squirrelmail — versions 1.0.4, 1.0.5, 1.2.0
  • N/a — versions n/a

References