CVE-2009-0030
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard…
Does this matter?
Lower severity and a low EPSS score (1.68%). Track it; it rarely justifies an emergency change on its own.
Description
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 1.68% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- squirrelmail/squirrelmail
- Source
- secalert@redhat.com
References
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
- http://secunia.com/advisories/33611Vendor Advisory
- http://securitytracker.com/id?1021611
- http://www.securityfocus.com/bid/33354
- https://bugzilla.redhat.com/show_bug.cgi?id=480224
- https://bugzilla.redhat.com/show_bug.cgi?id=480488
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48115
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10366
- https://rhn.redhat.com/errata/RHSA-2009-0057.html
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
- http://secunia.com/advisories/33611Vendor Advisory
- http://securitytracker.com/id?1021611
- http://www.securityfocus.com/bid/33354
- https://bugzilla.redhat.com/show_bug.cgi?id=480224
- https://bugzilla.redhat.com/show_bug.cgi?id=480488
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48115
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10366
- https://rhn.redhat.com/errata/RHSA-2009-0057.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.