7.5

CVE-2005-0103

PHP remote file inclusion vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to execute arbitrary PHP code by modifying a URL parameter to reference a URL on a remote web server that contains the code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Squirrelmail ≫ Squirrelmail Version 1.0.4
Squirrelmail ≫ Squirrelmail Version 1.0.5
Squirrelmail ≫ Squirrelmail Version 1.2.0
Squirrelmail ≫ Squirrelmail Version 1.2.1
Squirrelmail ≫ Squirrelmail Version 1.2.2
Squirrelmail ≫ Squirrelmail Version 1.2.3
Squirrelmail ≫ Squirrelmail Version 1.2.4
Squirrelmail ≫ Squirrelmail Version 1.2.5
Squirrelmail ≫ Squirrelmail Version 1.2.6
Squirrelmail ≫ Squirrelmail Version 1.2.7
Squirrelmail ≫ Squirrelmail Version 1.2.8
Squirrelmail ≫ Squirrelmail Version 1.2.9
Squirrelmail ≫ Squirrelmail Version 1.2.10
Squirrelmail ≫ Squirrelmail Version 1.2.11
Squirrelmail ≫ Squirrelmail Version 1.4
Squirrelmail ≫ Squirrelmail Version 1.4.0
Squirrelmail ≫ Squirrelmail Version 1.4.1
Squirrelmail ≫ Squirrelmail Version 1.4.2
Squirrelmail ≫ Squirrelmail Version 1.4.3
Squirrelmail ≫ Squirrelmail Version 1.4.3_rc1
Squirrelmail ≫ Squirrelmail Version 1.4.3a
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.34% 0.814
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html
Patch
Vendor Advisory
http://marc.info/?l=bugtraq&m=110702772714662&w=2
http://secunia.com/advisories/13962/
Patch
Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200501-39.xml
http://www.redhat.com/support/errata/RHSA-2005-099.html
Patch
Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-135.html
Patch
Vendor Advisory
http://www.squirrelmail.org/security/issue/2005-01-19?PHPSESSID=8af117822fb1ca3aa966a64248b5d223
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/19037
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10670