CVE-2010-1637 — Server-Side Request Forgery in Squirrelmail

CWE-918 — Server-Side Request ForgeryCWE-441 — Confused Deputy8 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 32.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Apple MAC OS XApple MAC OS X ServerSquirrelmail+4 more
Timeline
PublishedJun 22
Latest updateMay 17

Description

The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages6 packages

▶NVDapple/mac_os_x< 10.6.8
▶NVDapple/mac_os_x_server< 10.6.8

Also affects: Fedora 11, 12, 13

Patches

Patch: squirrelmail.org ↗Patch: squirrelmail.svn.sourceforge.net ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-79mr-p6x2-hw9g: The Mail Fetch plugin in SquirrelMail 1↗2022-05-17
▶
CVEList
CVE-2010-1637: The Mail Fetch plugin in SquirrelMail 1↗2010-06-22
▶

📋Vendor Advisories

1
Red Hat
SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports↗2010-05-20
▶

📐Framework References

2
CWE
Unintended Proxy or Intermediary ('Confused Deputy')↗
▶
CWE
Server-Side Request Forgery (SSRF)↗
▶

💬Community

2
Bugzilla
CVE-2010-1637 SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports↗2010-06-21
▶
Bugzilla
CVE-2010-1637 SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports [fedora-all]↗2010-06-21
▶
CVE-2010-1637 — Server-Side Request Forgery | cvebase