SquirrelMail  
Donations
News
About
Support
Screen shots
Download
Plugins
Documentation
Sponsors
Bounties













Security Notice
Phishing campain
UPDATE YOUR
EMAIL SECURITY
"IUEU"

Security

CSRF in all forms

Date:
2009-08-12
Description:
All form submissions (send message, change preferences, etc.) in SquirrelMail were previously subject to cross-site request forgery (CSRF), wherein data could be sent to them from an offsite location, which could allow an attacker to inject malicious content into user preferences or possibly send emails without user consent.
Affected Versions:
<= 1.4.19
Register Globals:
Register_globals does not have to be on for this issue.
CVE ID(s):
SA34627
Patch:
view patch
Credits:
This page last updated:
2009-08-12 14:18:32
© 1999-2010 by The SquirrelMail Project Team