Published: 13/07/2005 Updated: 11/10/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

options_identities.php in SquirrelMail 1.4.4 and previous versions uses the extract function to process the $_POST variable, which allows remote malicious users to modify or read the preferences of other users, conduct cross-site scripting XSS) attacks, and write arbitrary files.

Vulnerable Product	Search on Vulmon	Subscribe to Product
squirrelmail squirrelmail 1.0.5
squirrelmail squirrelmail 1.2.0
squirrelmail squirrelmail 1.2.5
squirrelmail squirrelmail 1.2.6
squirrelmail squirrelmail 1.4.3
squirrelmail squirrelmail 1.4.3_rc1
squirrelmail squirrelmail 1.2.11
squirrelmail squirrelmail 1.2.2
squirrelmail squirrelmail 1.4
squirrelmail squirrelmail 1.4.0
squirrelmail squirrelmail 1.2.1
squirrelmail squirrelmail 1.2.10
squirrelmail squirrelmail 1.2.7
squirrelmail squirrelmail 1.2.8
squirrelmail squirrelmail 1.2.9
squirrelmail squirrelmail 1.4.3a
squirrelmail squirrelmail 1.44
squirrelmail squirrelmail 1.0.4
squirrelmail squirrelmail 1.2.3
squirrelmail squirrelmail 1.2.4
squirrelmail squirrelmail 1.4.1
squirrelmail squirrelmail 1.4.2

Synopsis squirrelmail security update Type/Severity Security Advisory: Moderate Topic An updated squirrelmail package that fixes two security issues is nowavailableThis update has been rated as having moderate security impact by the RedHat Security Response Team[Updated 04 Aug 2005]The previous SquirrelMa ...

SquirrelMail Arbitrary Variable Overwrite Vendor: The SquirrelMail Project Team Product: SquirrelMail Version: <= 145-RC1 Website: wwwsquirrelmailorg/ BID: 14254 CVE: CVE-2005-2095 SECUNIA: 16058 PACKETSTORM: 38709 Description: SquirrelMail is a standards-based webmail package written in php It includes built-in pure PHP suppo ...

NVD-CWE-noinfo http://www.debian.org/security/2005/dsa-756 http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163047 http://www.securityfocus.com/archive/1/405202 http://www.securityfocus.com/archive/1/405200 http://www.squirrelmail.org/security/issue/2005-07-13 http://www.redhat.com/support/errata/RHSA-2005-595.html http://www.securityfocus.com/bid/14254 http://www.gulftech.org/?node=research&article_id=00090-07142005 http://www.novell.com/linux/security/advisories/2005_18_sr.html https://exchange.xforce.ibmcloud.com/vulnerabilities/21359 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10500 https://access.redhat.com/errata/RHSA-2005:595 https://nvd.nist.gov https://www.exploit-db.com/exploits/43830/

CVE-2005-2095

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect