PT-2007-2683

CVE-2007-1262

Published

2007-05-11

Updated

2017-10-11

Description by

CVSS 2.0

4.3

Medium

MetricsAV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SquirrelMail versions 1.4.0 through 1.4.9a

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the HTML filter. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the data: URI in an HTML e-mail attachment or through various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.

Recommendations For SquirrelMail versions 1.4.0 through 1.4.9a, update to a version that includes a fix for the HTML filter vulnerabilities to prevent XSS attacks.

Exploitability

Fix

Impacts

Researchers

Yosuke Hasegawa

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2007-1262

DSA-1290-1