fkie_cve-2006-6142
Vulnerability from fkie_nvd
Published
2006-12-05 11:28
Modified
2025-04-09 00:30
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."
References
cve@mitre.orgftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc
cve@mitre.orghttp://docs.info.apple.com/article.html?artnum=306172
cve@mitre.orghttp://fedoranews.org/cms/node/2438
cve@mitre.orghttp://fedoranews.org/cms/node/2439
cve@mitre.orghttp://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
cve@mitre.orghttp://secunia.com/advisories/23195
cve@mitre.orghttp://secunia.com/advisories/23322
cve@mitre.orghttp://secunia.com/advisories/23409
cve@mitre.orghttp://secunia.com/advisories/23504
cve@mitre.orghttp://secunia.com/advisories/23811
cve@mitre.orghttp://secunia.com/advisories/24004
cve@mitre.orghttp://secunia.com/advisories/24284
cve@mitre.orghttp://secunia.com/advisories/26235
cve@mitre.orghttp://securitytracker.com/id?1017327
cve@mitre.orghttp://sourceforge.net/project/shownotes.php?release_id=468482
cve@mitre.orghttp://squirrelmail.org/security/issue/2006-12-02
cve@mitre.orghttp://www.debian.org/security/2006/dsa-1241
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDKSA-2006:226
cve@mitre.orghttp://www.novell.com/linux/security/advisories/2006_29_sr.html
cve@mitre.orghttp://www.novell.com/linux/security/advisories/2007_4_sr.html
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2007-0022.html
cve@mitre.orghttp://www.securityfocus.com/bid/21414
cve@mitre.orghttp://www.securityfocus.com/bid/25159
cve@mitre.orghttp://www.vupen.com/english/advisories/2006/4828
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/2732
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/30693
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/30694
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/30695
cve@mitre.orghttps://issues.rpath.com/browse/RPL-849
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9988
af854a3a-2127-422b-91ae-364da2661108ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc
af854a3a-2127-422b-91ae-364da2661108http://docs.info.apple.com/article.html?artnum=306172
af854a3a-2127-422b-91ae-364da2661108http://fedoranews.org/cms/node/2438
af854a3a-2127-422b-91ae-364da2661108http://fedoranews.org/cms/node/2439
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/23195
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/23322
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/23409
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/23504
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/23811
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/24004
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/24284
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26235
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1017327
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/project/shownotes.php?release_id=468482
af854a3a-2127-422b-91ae-364da2661108http://squirrelmail.org/security/issue/2006-12-02
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2006/dsa-1241
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDKSA-2006:226
af854a3a-2127-422b-91ae-364da2661108http://www.novell.com/linux/security/advisories/2006_29_sr.html
af854a3a-2127-422b-91ae-364da2661108http://www.novell.com/linux/security/advisories/2007_4_sr.html
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2007-0022.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/21414
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/25159
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/4828
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/2732
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/30693
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/30694
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/30695
af854a3a-2127-422b-91ae-364da2661108https://issues.rpath.com/browse/RPL-849
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9988
Impacted products
Vendor Product Version
squirrelmail squirrelmail 1.4
squirrelmail squirrelmail 1.4.1
squirrelmail squirrelmail 1.4.2
squirrelmail squirrelmail 1.4.3
squirrelmail squirrelmail 1.4.3_r3
squirrelmail squirrelmail 1.4.3_rc1
squirrelmail squirrelmail 1.4.3aa
squirrelmail squirrelmail 1.4.4
squirrelmail squirrelmail 1.4.4_rc1
squirrelmail squirrelmail 1.4.5
squirrelmail squirrelmail 1.4.6
squirrelmail squirrelmail 1.4.6_cvs
squirrelmail squirrelmail 1.4.6_rc1
squirrelmail squirrelmail 1.4.7
squirrelmail squirrelmail 1.4_rc1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "026730B8-3919-4100-8607-C640ADBDD662",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AD31177-05BB-4623-AED7-765DB7E44E47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "20247A22-9AB9-4BCE-BF28-350B52FBC62D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "79E6734C-EE1C-40B6-9759-15298707A6F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_r3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6733B8C-5A9E-45CE-8938-F39A69EB0DC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B08E51F1-3764-4146-89C1-20B9B8EE1222",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.3aa:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4AAFE2B-77AB-4AC3-A22C-C3C256E2E45A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF6591E5-5F36-4663-85A6-9D870FD49FC7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.4_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D062B70A-E5FF-403B-8BD1-777D6462B7CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D4CFD4D-EAC3-4325-A87F-9D5F4C513208",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A884536-4D27-4350-B815-AB4E625879DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_cvs:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CD09187-16B2-4A0C-907C-40375E865EBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7ED3CC3-E0A8-4C20-9EF7-405CD32E9EF7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD89F143-EEBF-472D-9653-E7534F5799FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:squirrelmail:squirrelmail:1.4_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "442BF5C9-DC58-4A94-A634-33D6A4F3C6DD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving \"a shortcoming in the magicHTML filter.\""
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en SquirrelMail 1.4.0 hasta 1.4.9 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante el (1) par\u00e1metro mailto en (a) webmail.php, los par\u00e1metros (2) session y (3) delete_draft en (b) compose.php, y (4) vectores no especificados implicando \"a shortcoming in the magicHTML filter.\""
    }
  ],
  "id": "CVE-2006-6142",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-12-05T11:28:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://docs.info.apple.com/article.html?artnum=306172"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://fedoranews.org/cms/node/2438"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://fedoranews.org/cms/node/2439"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/23195"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/23322"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/23409"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/23504"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/23811"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/24004"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/24284"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/26235"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1017327"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sourceforge.net/project/shownotes.php?release_id=468482"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://squirrelmail.org/security/issue/2006-12-02"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2006/dsa-1241"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:226"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.novell.com/linux/security/advisories/2006_29_sr.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.novell.com/linux/security/advisories/2007_4_sr.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0022.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/21414"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/25159"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/4828"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/2732"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30693"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30694"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30695"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://issues.rpath.com/browse/RPL-849"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9988"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://docs.info.apple.com/article.html?artnum=306172"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://fedoranews.org/cms/node/2438"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://fedoranews.org/cms/node/2439"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/23195"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/23322"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/23409"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/23504"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/23811"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/24004"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/24284"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/26235"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1017327"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sourceforge.net/project/shownotes.php?release_id=468482"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://squirrelmail.org/security/issue/2006-12-02"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2006/dsa-1241"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:226"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.novell.com/linux/security/advisories/2006_29_sr.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.novell.com/linux/security/advisories/2007_4_sr.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/21414"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/25159"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/4828"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/2732"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30693"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30694"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30695"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://issues.rpath.com/browse/RPL-849"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9988"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vendorComments": [
    {
      "comment": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
      "lastModified": "2007-03-14T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.