Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-1580

Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie.

Published

2009-05-14T17:30:00.703

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

4.9

Weaknesses

Type: Primary
CWE-287

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	squirrelmail	squirrelmail	≤ 1.4.17	Yes
Application	squirrelmail	squirrelmail	0.1	Yes
Application	squirrelmail	squirrelmail	0.1.1	Yes
Application	squirrelmail	squirrelmail	0.1.2	Yes
Application	squirrelmail	squirrelmail	0.2	Yes
Application	squirrelmail	squirrelmail	0.2.1	Yes
Application	squirrelmail	squirrelmail	0.3	Yes
Application	squirrelmail	squirrelmail	0.3.1	Yes
Application	squirrelmail	squirrelmail	0.3pre1	Yes
Application	squirrelmail	squirrelmail	0.3pre2	Yes
Application	squirrelmail	squirrelmail	0.4	Yes
Application	squirrelmail	squirrelmail	0.4pre1	Yes
Application	squirrelmail	squirrelmail	0.4pre2	Yes
Application	squirrelmail	squirrelmail	0.5	Yes
Application	squirrelmail	squirrelmail	0.5pre1	Yes
Application	squirrelmail	squirrelmail	0.5pre2	Yes
Application	squirrelmail	squirrelmail	1.0	Yes
Application	squirrelmail	squirrelmail	1.0.1	Yes
Application	squirrelmail	squirrelmail	1.0.2	Yes
Application	squirrelmail	squirrelmail	1.0.3	Yes
Application	squirrelmail	squirrelmail	1.0.4	Yes
Application	squirrelmail	squirrelmail	1.0.5	Yes
Application	squirrelmail	squirrelmail	1.0.6	Yes
Application	squirrelmail	squirrelmail	1.0pre1	Yes
Application	squirrelmail	squirrelmail	1.0pre2	Yes
Application	squirrelmail	squirrelmail	1.0pre3	Yes
Application	squirrelmail	squirrelmail	1.1.0	Yes
Application	squirrelmail	squirrelmail	1.1.2	Yes
Application	squirrelmail	squirrelmail	1.1.3	Yes
Application	squirrelmail	squirrelmail	1.2	Yes
Application	squirrelmail	squirrelmail	1.2.0	Yes
Application	squirrelmail	squirrelmail	1.2.0	Yes
Application	squirrelmail	squirrelmail	1.2.1	Yes
Application	squirrelmail	squirrelmail	1.2.2	Yes
Application	squirrelmail	squirrelmail	1.2.3	Yes
Application	squirrelmail	squirrelmail	1.2.4	Yes
Application	squirrelmail	squirrelmail	1.2.5	Yes
Application	squirrelmail	squirrelmail	1.2.6	Yes
Application	squirrelmail	squirrelmail	1.2.7	Yes
Application	squirrelmail	squirrelmail	1.2.8	Yes
Application	squirrelmail	squirrelmail	1.2.9	Yes
Application	squirrelmail	squirrelmail	1.2.10	Yes
Application	squirrelmail	squirrelmail	1.2.11	Yes
Application	squirrelmail	squirrelmail	1.3.0	Yes
Application	squirrelmail	squirrelmail	1.4	Yes
Application	squirrelmail	squirrelmail	1.4	Yes
Application	squirrelmail	squirrelmail	1.4.0	Yes
Application	squirrelmail	squirrelmail	1.4.0	Yes
Application	squirrelmail	squirrelmail	1.4.0	Yes
Application	squirrelmail	squirrelmail	1.4.1	Yes
Application	squirrelmail	squirrelmail	1.4.2	Yes
Application	squirrelmail	squirrelmail	1.4.3	Yes
Application	squirrelmail	squirrelmail	1.4.3	Yes
Application	squirrelmail	squirrelmail	1.4.3	Yes
Application	squirrelmail	squirrelmail	1.4.3a	Yes
Application	squirrelmail	squirrelmail	1.4.3aa	Yes
Application	squirrelmail	squirrelmail	1.4.4	Yes
Application	squirrelmail	squirrelmail	1.4.4	Yes
Application	squirrelmail	squirrelmail	1.4.5	Yes
Application	squirrelmail	squirrelmail	1.4.6	Yes
Application	squirrelmail	squirrelmail	1.4.6	Yes
Application	squirrelmail	squirrelmail	1.4.7	Yes
Application	squirrelmail	squirrelmail	1.4.8.4fc6	Yes
Application	squirrelmail	squirrelmail	1.4.9	Yes
Application	squirrelmail	squirrelmail	1.4.9a	Yes
Application	squirrelmail	squirrelmail	1.4.10a	Yes
Application	squirrelmail	squirrelmail	1.4.11	Yes
Application	squirrelmail	squirrelmail	1.4.12	Yes
Application	squirrelmail	squirrelmail	1.4.15	Yes
Application	squirrelmail	squirrelmail	1.4.15	Yes
Application	squirrelmail	squirrelmail	1.4.16	Yes
Application	squirrelmail	squirrelmail	1.44	Yes

References

http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html ([email protected])
http://secunia.com/advisories/35052 Vendor Advisory ([email protected])
http://secunia.com/advisories/35073 Vendor Advisory ([email protected])
http://secunia.com/advisories/35140 ([email protected])
http://secunia.com/advisories/40220 ([email protected])
http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog ([email protected])
http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13676 Patch, Vendor Advisory ([email protected])
http://support.apple.com/kb/HT4188 ([email protected])
http://www.debian.org/security/2009/dsa-1802 ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2009:110 ([email protected])
http://www.securityfocus.com/bid/34916 Patch ([email protected])
http://www.squirrelmail.org/security/issue/2009-05-11 Patch, Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2009/1296 Patch, Vendor Advisory ([email protected])
http://www.vupen.com/english/advisories/2010/1481 ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=500358 ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/50462 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10107 ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00566.html ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00572.html ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00577.html ([email protected])
http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35052 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35073 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35140 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/40220 (af854a3a-2127-422b-91ae-364da2661108)
http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog (af854a3a-2127-422b-91ae-364da2661108)
http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13676 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://support.apple.com/kb/HT4188 (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2009/dsa-1802 (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2009:110 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/34916 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.squirrelmail.org/security/issue/2009-05-11 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/1296 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2010/1481 (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=500358 (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/50462 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10107 (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00566.html (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00572.html (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00577.html (af854a3a-2127-422b-91ae-364da2661108)