Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:28
Type | Values Removed | Values Added |
---|---|---|
References | () http://rhn.redhat.com/errata/RHSA-2012-0103.html - | |
References | () http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14119 - Patch | |
References | () http://www.debian.org/security/2011/dsa-2291 - | |
References | () http://www.mandriva.com/security/advisories?name=MDVSA-2011:123 - | |
References | () https://bugzilla.redhat.com/show_bug.cgi?id=720694 - Patch | |
References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/68586 - |
Information
Published : 2011-07-17 20:55
Updated : 2024-11-21 01:28
NVD link : CVE-2011-2753
Mitre link : CVE-2011-2753
CVE.ORG link : CVE-2011-2753
JSON object : View
Products Affected
squirrelmail
- squirrelmail
CWE
CWE-352
Cross-Site Request Forgery (CSRF)