ID CVE-2004-0519
Summary Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.
References
Vulnerable Configurations
  • cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*
    cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 11-10-2017 - 01:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
assigner via4 cve@mitre.org
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
non_vulnerable_configuration via4
    oval via4
    • accepted 2010-09-20T04:00:03.552-04:00
      class vulnerability
      contributors
      • name Jay Beale
        organization Bastille Linux
      • name Jonathan Baker
        organization The MITRE Corporation
      description Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.
      family unix
      id oval:org.mitre.oval:def:1006
      status accepted
      submitted 2004-06-29T12:00:00.000-04:00
      title SquirrelMail Cross-site Scripting Vulnerability I
      version 7
    • accepted 2013-04-29T04:04:13.841-04:00
      class vulnerability
      contributors
      • name Aharon Chernin
        organization SCAP.com, LLC
      • name Dragos Prisaca
        organization G2, Inc.
      definition_extensions
      • comment The operating system installed on the system is Red Hat Enterprise Linux 3
        oval oval:org.mitre.oval:def:11782
      • comment CentOS Linux 3.x
        oval oval:org.mitre.oval:def:16651
      description Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.
      family unix
      id oval:org.mitre.oval:def:10274
      status accepted
      submitted 2010-07-09T03:56:16-04:00
      title Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.
      version 23
    redhat via4
    advisories
    rhsa
    id RHSA-2004:240
    refmap via4
    bid 10246
    bugtraq
    • 20040429 SquirrelMail Cross Scripting Attacks....
    • 20040430 Re: SquirrelMail Cross Scripting Attacks....
    conectiva CLA-2004:858
    debian DSA-535
    fedora
    • FEDORA-2004-160
    • FEDORA-2004-1733
    gentoo GLSA-200405-16
    secunia
    • 11531
    • 11686
    • 11870
    • 12289
    sgi 20040604-01-U
    suse SUSE-SR:2005:019
    xf squirrel-composephp-xss(16025)
    vulnerable_product via4
    • cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*
    Last major update 11-10-2017 - 01:29
    Published 18-08-2004 - 04:00
    Back to Top