6.8

CVE-2011-2753

Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Squirrelmail ≫ Squirrelmail Version <= 1.4.21
Squirrelmail ≫ Squirrelmail Version 0.1
Squirrelmail ≫ Squirrelmail Version 0.1.1
Squirrelmail ≫ Squirrelmail Version 0.1.2
Squirrelmail ≫ Squirrelmail Version 0.2
Squirrelmail ≫ Squirrelmail Version 0.2.1
Squirrelmail ≫ Squirrelmail Version 0.3
Squirrelmail ≫ Squirrelmail Version 0.3.1
Squirrelmail ≫ Squirrelmail Version 0.3pre1
Squirrelmail ≫ Squirrelmail Version 0.3pre2
Squirrelmail ≫ Squirrelmail Version 0.4
Squirrelmail ≫ Squirrelmail Version 0.4pre1
Squirrelmail ≫ Squirrelmail Version 0.4pre2
Squirrelmail ≫ Squirrelmail Version 0.5
Squirrelmail ≫ Squirrelmail Version 0.5pre1
Squirrelmail ≫ Squirrelmail Version 0.5pre2
Squirrelmail ≫ Squirrelmail Version 1.0
Squirrelmail ≫ Squirrelmail Version 1.0.1
Squirrelmail ≫ Squirrelmail Version 1.0.2
Squirrelmail ≫ Squirrelmail Version 1.0.3
Squirrelmail ≫ Squirrelmail Version 1.0.4
Squirrelmail ≫ Squirrelmail Version 1.0.5
Squirrelmail ≫ Squirrelmail Version 1.0.6
Squirrelmail ≫ Squirrelmail Version 1.0pre1
Squirrelmail ≫ Squirrelmail Version 1.0pre2
Squirrelmail ≫ Squirrelmail Version 1.0pre3
Squirrelmail ≫ Squirrelmail Version 1.1.0
Squirrelmail ≫ Squirrelmail Version 1.1.1
Squirrelmail ≫ Squirrelmail Version 1.1.2
Squirrelmail ≫ Squirrelmail Version 1.1.3
Squirrelmail ≫ Squirrelmail Version 1.2
Squirrelmail ≫ Squirrelmail Version 1.2.0
Squirrelmail ≫ Squirrelmail Version 1.2.0 Update rc3
Squirrelmail ≫ Squirrelmail Version 1.2.1
Squirrelmail ≫ Squirrelmail Version 1.2.2
Squirrelmail ≫ Squirrelmail Version 1.2.3
Squirrelmail ≫ Squirrelmail Version 1.2.4
Squirrelmail ≫ Squirrelmail Version 1.2.5
Squirrelmail ≫ Squirrelmail Version 1.2.6
Squirrelmail ≫ Squirrelmail Version 1.2.6 Update rc1
Squirrelmail ≫ Squirrelmail Version 1.2.7
Squirrelmail ≫ Squirrelmail Version 1.2.8
Squirrelmail ≫ Squirrelmail Version 1.2.9
Squirrelmail ≫ Squirrelmail Version 1.2.10
Squirrelmail ≫ Squirrelmail Version 1.2.11
Squirrelmail ≫ Squirrelmail Version 1.3.0
Squirrelmail ≫ Squirrelmail Version 1.3.1
Squirrelmail ≫ Squirrelmail Version 1.3.2
Squirrelmail ≫ Squirrelmail Version 1.4
Squirrelmail ≫ Squirrelmail Version 1.4 Update rc1
Squirrelmail ≫ Squirrelmail Version 1.4.0
Squirrelmail ≫ Squirrelmail Version 1.4.0 Update rc1
Squirrelmail ≫ Squirrelmail Version 1.4.0 Update rc2a
Squirrelmail ≫ Squirrelmail Version 1.4.0-r1
Squirrelmail ≫ Squirrelmail Version 1.4.1
Squirrelmail ≫ Squirrelmail Version 1.4.2
Squirrelmail ≫ Squirrelmail Version 1.4.2-r1
Squirrelmail ≫ Squirrelmail Version 1.4.2-r2
Squirrelmail ≫ Squirrelmail Version 1.4.2-r3
Squirrelmail ≫ Squirrelmail Version 1.4.2-r4
Squirrelmail ≫ Squirrelmail Version 1.4.2-r5
Squirrelmail ≫ Squirrelmail Version 1.4.3
Squirrelmail ≫ Squirrelmail Version 1.4.3 Update r3
Squirrelmail ≫ Squirrelmail Version 1.4.3 Update rc1
Squirrelmail ≫ Squirrelmail Version 1.4.3a
Squirrelmail ≫ Squirrelmail Version 1.4.3aa
Squirrelmail ≫ Squirrelmail Version 1.4.4
Squirrelmail ≫ Squirrelmail Version 1.4.4 Update rc1
Squirrelmail ≫ Squirrelmail Version 1.4.5
Squirrelmail ≫ Squirrelmail Version 1.4.5 Update rc1
Squirrelmail ≫ Squirrelmail Version 1.4.6
Squirrelmail ≫ Squirrelmail Version 1.4.6 Update rc1
Squirrelmail ≫ Squirrelmail Version 1.4.6_cvs
Squirrelmail ≫ Squirrelmail Version 1.4.7
Squirrelmail ≫ Squirrelmail Version 1.4.8
Squirrelmail ≫ Squirrelmail Version 1.4.8.4fc6
Squirrelmail ≫ Squirrelmail Version 1.4.9
Squirrelmail ≫ Squirrelmail Version 1.4.9a
Squirrelmail ≫ Squirrelmail Version 1.4.10
Squirrelmail ≫ Squirrelmail Version 1.4.10a
Squirrelmail ≫ Squirrelmail Version 1.4.11
Squirrelmail ≫ Squirrelmail Version 1.4.12
Squirrelmail ≫ Squirrelmail Version 1.4.13
Squirrelmail ≫ Squirrelmail Version 1.4.15
Squirrelmail ≫ Squirrelmail Version 1.4.15 Update rc1
Squirrelmail ≫ Squirrelmail Version 1.4.15rc1
Squirrelmail ≫ Squirrelmail Version 1.4.16
Squirrelmail ≫ Squirrelmail Version 1.4.17
Squirrelmail ≫ Squirrelmail Version 1.4.18
Squirrelmail ≫ Squirrelmail Version 1.4.19
Squirrelmail ≫ Squirrelmail Version 1.4.20
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.08% 0.607
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://rhn.redhat.com/errata/RHSA-2012-0103.html
http://www.debian.org/security/2011/dsa-2291
http://www.mandriva.com/security/advisories?name=MDVSA-2011:123
http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119
Patch
https://bugzilla.redhat.com/show_bug.cgi?id=720694
Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/68586