Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2004-0639

4 documents4 sources
Severity
6.8MEDIUM
EPSS
3.6%
top 12.17%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Open Webmail Open WebmailSGI PropackSquirrelmail Squirrelmail
Timeline
PublishedAug 6
Latest updateApr 29

Description

Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages3 packages

▶NVDsquirrelmail/squirrelmail17 versions+16
▶NVDsgi/propack3.0
▶NVDopen_webmail/open_webmail2.30, 2.31, 2.32+2

Patches

Patch: www.debian.org ↗Patch: www.securityfocus.com ↗Patch: www.debian.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-mw77-9679-948g: Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1↗2022-04-29
▶
CVEList
CVE-2004-0639: Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1↗2004-07-09
▶

💥Exploits & PoCs

1
Exploit-DB
SquirrelMail 1.2.x - From Email Header HTML Injection↗2004-06-03
▶
CVE-2004-0639 (MEDIUM CVSS 6.8) | Multiple cross-site scripting (XSS) | cvebase.io