Debian Linux Security Advisory 2091-1 - SquirrelMail, a webmail application, does not employ a user-specific token for webforms. This allows a remote attacker to perform a Cross Site Request Forgery (CSRF) attack. The attacker may hijack the authentication of unspecified victims and send messages or change user preferences among other actions, by tricking the victim into following a link controlled by the offender.
c13d0155e8d506e4d62fbfc57b7bb70ebe54c5bd30afef96a0c7857619a5ed67Mandriva Linux Security Advisory 2009-222 - All form submissions (send message, change preferences, etc.) in SquirrelMail were previously subject to cross-site request forgery (CSRF), wherein data could be sent to them from an offsite location, which could allow an attacker to inject malicious content into user preferences or possibly send emails without user consent. This update provides a solution to this vulnerability.
775e8598d016b35e3b7442c1ecd1cc3cd586d146f8d103a5ec7900d9e522ca8e
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed