Name of the Vulnerable Software and Affected Versions:
SquirrelMail versions prior to 1.4.18
NaSMail versions prior to 1.7
Description:
The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible through various vectors, including certain encrypted strings in e-mail headers related to contrib/decrypt headers.php, PHP SELF, and the query string.
Recommendations:
For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue.
For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue.
As a temporary workaround, consider restricting access to the contrib/decrypt headers.php module and limiting the use of PHP SELF and query strings in affected API endpoints until a patch is available.