CVE-2009-2964: squirrelmail Cross-Site Request Forgery (CSRF)

CVSS: 6.8v2.0MediumModified

AliasesRHSA-2009:1490

Published 25-08-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-2964 is a medium (CVSS 6.8) Cross-Site Request Forgery (CSRF) vulnerability in squirrelmail. EPSS estimates a 1.52% chance of exploitation in the next 30 days, higher than 74.1% of scored vulnerabilities.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

1.52%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

DSA-2091-1

Timeline

25-08-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

1.52%

Chance of exploitation in the next 30 days

Percentile

74%

Versus all other CVEs

30-day change

0.00 pp

From 1.52% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.52%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Affected systems

Redhat1 product

squirrelmail< 0:1.4.8-16.el3 | < 0:1.4.8-5.el4_8.8 | < 0:1.4.8-5.el5_4.10

Squirrelmail1 product

squirrelmail≤ 1.4.19 | 0.1.1 | 0.1.2 | 1.0 | 1.0.1 | 1.0.2 | 1.0.3 | 1.0.4 | 1.0.5 | 1.0.6 | 1.0pre1 | 1.0pre2 | 1.0pre3 | 1.1.0 | 1.1.1 | 1.1.2 | 1.1.3 | 1.2 | 1.2.0 | 1.2.0:rc3 | 1.2.0_rc3 | 1.2.1 | 1.2.2 | 1.2.3 | 1.2.4 | 1.2.5 | 1.2.6 | 1.2.6-rc1 | 1.2.7 | 1.2.8 | 1.2.9 | 1.2.10 | 1.2.11 | 1.3.0 | 1.3.1 | 1.3.2 | 1.4 | 1.4:rc1 | 1.4.0 | 1.4.0:rc1 | 1.4.0:rc2a | 1.4.0-r1 | 1.4.0_rc1 | 1.4.0_rc2a | 1.4.1 | 1.4.2 | 1.4.2-r1 | 1.4.2-r2 | 1.4.2-r3 | 1.4.2-r4 | 1.4.2-r5 | 1.4.3 | 1.4.3:r3 | 1.4.3:rc1 | 1.4.3_r3 | 1.4.3_rc1 | 1.4.3_rc1:r1 | 1.4.3a | 1.4.3aa | 1.4.4 | 1.4.4:rc1 | 1.4.4_rc1 | 1.4.5 | 1.4.5_rc1 | 1.4.6 | 1.4.6:rc1 | 1.4.6_cvs | 1.4.6_rc1 | 1.4.7 | 1.4.8 | 1.4.8.4fc6 | 1.4.9 | 1.4.9a | 1.4.10 | 1.4.10a | 1.4.11 | 1.4.12 | 1.4.13 | 1.4.15 | 1.4.15:rc1 | 1.4.15_rc1 | 1.4.15rc1 | 1.4.16 | 1.4.17 | 1.4.18 | 1.4_rc1

2 vendors · 2 products