Summary
This host is running SquirrelMail and is prone to multiple Cross Site Request Forgery vulnerabilities.
Impact
Attacker may leverage this issue to modify user preferences, delete emails, and potentially send emails, and can hijack the authentication of unspecified victims.
Impact Level: System/Application
Solution
Upgrade to version 1.4.20 RC1 or latest
http://www.squirrelmail.org/download.php
or
Apply Patch from below link
http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818
Insight
Multiple CSRF errors are caused via features such as send message and change preferences, related to addrbook_search_html.php, folders_rename_getname.php, folders_rename_do.php, folders_subscribe.php, move_messages.php, options.php, options_highlight.php, options_identities.php, options_order.php, search.php, addressbook.php, compose.php, folders.php, folders_create.php, vcard.php and folders_delete.php in /src and mailbox_display.php in functions directory.
Affected
SquirrelMail version 1.4.19 and prior on Linux.
References
Severity
Classification
-
CVE CVE-2009-2964 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities