CVE-2007-2589

SquirrelMail 1.4.0-1.4.9a - Cross-Site Request Forgery via IMG SRC Attribute

Title source: llm
STIX 2.1

Description

Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary users via certain data in the SRC attribute of an IMG element.

References (16)

Core 16
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/34219
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/2732
Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25200
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/1748
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25320
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
Issue Tracking x_refsource_confirm
http://www.squirrelmail.org/security/issue/2007-05-09
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2007:106
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2007_13_sr.html
Vendor Advisory x_refsource_confirm
http://docs.info.apple.com/article.html?artnum=306172
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11448
Vendor Advisory vendor-advisory x_refsource_redhat
https://rhn.redhat.com/errata/RHSA-2007-0358.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/25159
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/35889
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25787
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26235

Scores

EPSS 0.0137
EPSS Percentile 68.8%

Details

CWE
CWE-352
Status published
Products (18)
squirrelmail/squirrelmail 1.4.0
squirrelmail/squirrelmail 1.4.1
squirrelmail/squirrelmail 1.4.2
squirrelmail/squirrelmail 1.4.3
squirrelmail/squirrelmail 1.4.3_r3
squirrelmail/squirrelmail 1.4.3_rc1
squirrelmail/squirrelmail 1.4.3a
squirrelmail/squirrelmail 1.4.3aa
squirrelmail/squirrelmail 1.4.4
squirrelmail/squirrelmail 1.4.4_rc1
... and 8 more
Published May 11, 2007
Tracked Since Feb 18, 2026