Unscored severity · published Jul 17, 2011
CVE-2011-2753
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Squirrelmail · Squirrelmail
through 1.4.21; 0.1; 0.1.1; 0.1.2; 0.2; 0.2.1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2753
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-0103.html
Patch
http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119
www.debian.org
http://www.debian.org/security/2011/dsa-2291
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2011:123
Patch
https://bugzilla.redhat.com/show_bug.cgi?id=720694
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/68586
More from Squirrelmail
9.8
CVE-2020-14932
compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request
8.8
CVE-2020-14933
compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request
8.8
CVE-2018-8741
A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the…
8.8
CVE-2017-7692
SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call
6.5
CVE-2010-1637
The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal…