ID CVE-2005-2769
Summary Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via an HTML e-mail containing tags with strings that contain ">" or other special characters, which is not properly sanitized by SqWebMail.
References
Vulnerable Configurations
  • cpe:2.3:a:inter7:sqwebmail:5.0.4
    cpe:2.3:a:inter7:sqwebmail:5.0.4
CVSS
Base: 4.3 (as of 06-09-2005 - 08:40)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
exploit-db via4
description SqWebMail 5.0 .4 HTML Email IMG Tag Script Injection Vulnerability. CVE-2005-2769. Webapps exploit for php platform
id EDB-ID:26200
last seen 2016-02-03
modified 2005-08-29
published 2005-08-29
reporter Jakob Balle
source https://www.exploit-db.com/download/26200/
title SqWebMail 5.0.4 - HTML Email IMG Tag Script Injection Vulnerability
nessus via4
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-201-1.NASL
    description Several Cross Site Scripting vulnerabilities were discovered in SqWebmail. A remote attacker could exploit this to execute arbitrary JavaScript or other active HTML embeddable content in the web browser of an SqWebmail user by sending specially crafted emails to him. Please note that the 'sqwebmail' package is not officially supported by Ubuntu (it is in the 'universe' section of the archive). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-08-15
    plugin id 20617
    published 2006-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=20617
    title Ubuntu 4.10 / 5.04 : courier vulnerabilities (USN-201-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-793.NASL
    description Jakob Balle discovered a vulnerability in the handling of attachments in sqwebmail, a web mail application provided by the courier mail suite, which can be exploited by an attacker to conduct script insertion attacks.
    last seen 2019-02-21
    modified 2018-07-20
    plugin id 19563
    published 2005-09-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=19563
    title Debian DSA-793-1 : courier - missing input sanitising
refmap via4
bid 14676
bugtraq 20050829 Secunia Research: SqWebMail HTML Emails Script Insertion
fulldisc 20050829 Secunia Research: SqWebMail HTML Emails Script Insertion Vulnerability
misc http://secunia.com/secunia_research/2005-39/advisory/
secunia
  • 16600
  • 17156
ubuntu USN-201-1
xf sqwebmail-html-xss(22043)
Last major update 17-10-2016 - 23:30
Published 02-09-2005 - 19:03
Last modified 25-10-2017 - 21:29
Back to Top