SquirrelMail up to 1.4.22 formaction Message cross site scripting

Summaryinfo

A vulnerability marked as problematic has been reported in SquirrelMail up to 1.4.22. This impacts an unknown function of the component formaction Handler. Performing a manipulation as part of Message results in cross site scripting. This vulnerability is reported as CVE-2018-14954. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in SquirrelMail up to 1.4.22 (Mail Client Software). This affects an unknown code of the component formaction Handler. The manipulation as part of a Message leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute.

The bug was discovered 07/26/2018. The weakness was disclosed 08/05/2018 (Website). The advisory is shared at openwall.com. This vulnerability is uniquely identified as CVE-2018-14954 since 08/05/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 10 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-122633, VDB-122634, VDB-122635 and VDB-122636 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Mail Client Software

Name

• SquirrelMail

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7
• 1.4.8
• 1.4.9
• 1.4.10
• 1.4.11
• 1.4.12
• 1.4.13
• 1.4.14
• 1.4.15
• 1.4.16
• 1.4.17
• 1.4.18
• 1.4.19
• 1.4.20
• 1.4.21
• 1.4.22

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion