Published: 14/05/2009 Updated: 29/09/2017

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

Session fixation vulnerability in SquirrelMail prior to 1.4.18 allows remote malicious users to hijack web sessions via a crafted cookie.

Vulnerable Product	Search on Vulmon	Subscribe to Product
squirrelmail squirrelmail 0.3
squirrelmail squirrelmail 0.3.1
squirrelmail squirrelmail 1.0.4
squirrelmail squirrelmail 1.0.5
squirrelmail squirrelmail 1.2.0
squirrelmail squirrelmail 1.2.1
squirrelmail squirrelmail 1.2.7
squirrelmail squirrelmail 1.2.8
squirrelmail squirrelmail 1.4.1
squirrelmail squirrelmail 1.4.10a
squirrelmail squirrelmail 1.4.2
squirrelmail squirrelmail 1.4.3
squirrelmail squirrelmail 1.4.6
squirrelmail squirrelmail 1.0pre3
squirrelmail squirrelmail 1.0pre2
squirrelmail squirrelmail 0.3pre2
squirrelmail squirrelmail 0.4
squirrelmail squirrelmail 0.5
squirrelmail squirrelmail 1.0.6
squirrelmail squirrelmail 1.1.0
squirrelmail squirrelmail 1.2.10
squirrelmail squirrelmail 1.2.11
squirrelmail squirrelmail 1.2.9
squirrelmail squirrelmail 1.3.0
squirrelmail squirrelmail 1.4.11
squirrelmail squirrelmail 1.4.12
squirrelmail squirrelmail 1.4.7
squirrelmail squirrelmail 1.4.8.4fc6
squirrelmail squirrelmail 1.0pre1
squirrelmail squirrelmail 0.5pre2
squirrelmail squirrelmail 0.1
squirrelmail squirrelmail 0.1.1
squirrelmail squirrelmail 1.0
squirrelmail squirrelmail 1.0.1
squirrelmail squirrelmail 1.1.2
squirrelmail squirrelmail 1.1.3
squirrelmail squirrelmail 1.2.2
squirrelmail squirrelmail 1.2.3
squirrelmail squirrelmail 1.4
squirrelmail squirrelmail 1.4.0
squirrelmail squirrelmail 1.4.15
squirrelmail squirrelmail 1.4.3a
squirrelmail squirrelmail 1.4.3aa
squirrelmail squirrelmail 1.4.4
squirrelmail squirrelmail 1.4.9
squirrelmail squirrelmail 1.4.9a
squirrelmail squirrelmail 0.5pre1
squirrelmail squirrelmail 0.4pre2
squirrelmail squirrelmail 0.1.2
squirrelmail squirrelmail 0.2
squirrelmail squirrelmail 0.2.1
squirrelmail squirrelmail 1.0.2
squirrelmail squirrelmail 1.0.3
squirrelmail squirrelmail 1.2
squirrelmail squirrelmail 1.2.4
squirrelmail squirrelmail 1.2.5
squirrelmail squirrelmail 1.2.6
squirrelmail squirrelmail 1.4.16
squirrelmail squirrelmail
squirrelmail squirrelmail 1.4.5
squirrelmail squirrelmail 1.44
squirrelmail squirrelmail 0.4pre1
squirrelmail squirrelmail 0.3pre1

Synopsis Important: squirrelmail security update Type/Severity Security Advisory: Important Topic An updated squirrelmail package that fixes a security issue is nowavailable for Red Hat Enterprise Linux 3, 4 and 5This update has been rated as having important security impact by the RedHat Security Response ...

Debian Bug report logs - #528528 [squirrelmail] Please bring latest security-fix release 1418 Package: squirrelmail; Maintainer for squirrelmail is Jeroen van Wolffelaar <jeroen@wolffelaarnl>; Source for squirrelmail is src:squirrelmail (PTS, buildd, popcon) Reported by: Philippe Teuwen <phil@teuwenorg> Date: Wed ...

Several remote vulnerabilities have been discovered in SquirrelMail, a webmail application The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1578 Cross site scripting was possible through a number of pages which allowed an attacker to steal sensitive session data CVE-2009-1579, CVE-2009-1381 ...

CWE-287 http://secunia.com/advisories/35073 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00566.html http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13676 http://secunia.com/advisories/35052 http://www.securityfocus.com/bid/34916 http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog http://www.squirrelmail.org/security/issue/2009-05-11 https://bugzilla.redhat.com/show_bug.cgi?id=500358 http://www.mandriva.com/security/advisories?name=MDVSA-2009:110 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00577.html http://www.vupen.com/english/advisories/2009/1296 http://www.debian.org/security/2009/dsa-1802 http://secunia.com/advisories/35140 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00572.html http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html http://www.vupen.com/english/advisories/2010/1481 http://support.apple.com/kb/HT4188 http://secunia.com/advisories/40220 https://exchange.xforce.ibmcloud.com/vulnerabilities/50462 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10107 https://access.redhat.com/errata/RHSA-2009:0057 https://nvd.nist.gov https://www.debian.org/security/./dsa-1802

CVE-2009-1580

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect