Detections
Analytics
CVE-2009-2964
high
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.
References
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00954.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00927.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10668
https://gna.org/forum/forum.php?forum_id=2146
https://exchange.xforce.ibmcloud.com/vulnerabilities/52406
https://bugzilla.redhat.com/show_bug.cgi?id=517312
http://www.vupen.com/english/advisories/2010/2080
http://www.vupen.com/english/advisories/2010/1481
http://www.vupen.com/english/advisories/2009/3315
http://www.vupen.com/english/advisories/2009/2262
http://www.squirrelmail.org/security/issue/2009-08-12
http://www.securityfocus.com/bid/36196
http://www.mandriva.com/security/advisories?name=MDVSA-2009:222
http://www.debian.org/security/2010/dsa-2091
http://support.apple.com/kb/HT4188
http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818
http://secunia.com/advisories/40964
http://secunia.com/advisories/40220
http://secunia.com/advisories/37415
http://secunia.com/advisories/36363
http://secunia.com/advisories/34627
http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002207.html
http://jvn.jp/en/jp/JVN30881447/index.html