Login Request a demo
Unscored severity · published Oct 4, 2002
CVE-2002-1131
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3)…
–
CVSS
25.8%
EPSS
No
On KEV
Description
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)25.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Squirrelmail · Squirrelmail
through 1.2.7 · source: NVD
Affected product
SQ
Squirrelmail
Squirrelmail
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1131
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1131
Exploit
http://archives.neohapsis.com/archives/bugtraq/2002-09/0246.html
sourceforge.net
http://sourceforge.net/project/shownotes.php?group_id=311&release_id=110774
www.debian.org
http://www.debian.org/security/2002/dsa-191
Vendor Advisory
http://www.iss.net/security_center/static/10145.php
Patch
http://www.redhat.com/support/errata/RHSA-2002-204.html
Exploit
http://www.securityfocus.com/bid/5763
More from Squirrelmail
9.8
CVE-2020-14932
compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request
8.8
CVE-2020-14933
compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request
8.8
CVE-2018-8741
A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the…
8.8
CVE-2017-7692
SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call
6.5
CVE-2010-1637
The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal…