ID CVE-2005-2820
Summary Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via an e-mail message containing Internet Explorer "Conditional Comments" such as "[if]" and "[endif]".
References
Vulnerable Configurations
  • cpe:2.3:a:inter7:sqwebmail:5.0.4
    cpe:2.3:a:inter7:sqwebmail:5.0.4
CVSS
Base: 4.3 (as of 07-09-2005 - 15:45)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
nessus via4
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-201-1.NASL
    description Several Cross Site Scripting vulnerabilities were discovered in SqWebmail. A remote attacker could exploit this to execute arbitrary JavaScript or other active HTML embeddable content in the web browser of an SqWebmail user by sending specially crafted emails to him. Please note that the 'sqwebmail' package is not officially supported by Ubuntu (it is in the 'universe' section of the archive). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-08-15
    plugin id 20617
    published 2006-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=20617
    title Ubuntu 4.10 / 5.04 : courier vulnerabilities (USN-201-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-820.NASL
    description Jakob Balle discovered that with 'Conditional Comments' in Internet Explorer it is possible to hide JavaScript code in comments that will be executed when the browser views a malicious email via sqwebmail. Successful exploitation requires that the user is using Internet Explorer.
    last seen 2019-02-21
    modified 2018-08-09
    plugin id 19789
    published 2005-10-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=19789
    title Debian DSA-820-1 : courier - missing input sanitising
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-793.NASL
    description Jakob Balle discovered a vulnerability in the handling of attachments in sqwebmail, a web mail application provided by the courier mail suite, which can be exploited by an attacker to conduct script insertion attacks.
    last seen 2019-02-21
    modified 2018-07-20
    plugin id 19563
    published 2005-09-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=19563
    title Debian DSA-793-1 : courier - missing input sanitising
refmap via4
bugtraq 20050906 Secunia Research: SqWebMail Conditional Comments Script Insertion
debian DSA-820
misc
secunia
  • 16704
  • 17156
ubuntu USN-201-1
xf sqwebmail-html-comment-xss(22158)
Last major update 17-10-2016 - 23:30
Published 07-09-2005 - 15:07
Last modified 10-07-2017 - 21:33
Back to Top