Security

XSS vulnerability in message display

Date:

2011-07-10

Description:

Messages containing style tags with malicious script attributes were being displayed without being sanitized in SquirrelMail versions prior to 1.4.22.

Affected Versions:

<= 1.4.21

Register Globals:

Register_globals does not have to be on for this issue.

CVE ID(s):

CVE-2011-2023

Patch:

view patch

Credits:

This page last updated:

2011-07-12 00:00:00