JVNDB-2012-000021

SquirrelMail plugin Autocomplete vulnerable to cross-site scripting

The SquirrelMail plugin Autocomplete contains a cross-site scripting vulnerability.

The Autocomplete plugin in SquirrelMail searches for registered email addresses in user contacts as the user types into specific fields. The Autocomplete plugin contains a cross-site scripting vulnerability.

Masaki Konishi of M&K reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Base Metrics: 2.6 (Low) [IPA Score]

• Access Vector: Network
• Access Complexity: High
• Authentication: None
• Confidentiality Impact: None
• Integrity Impact: Partial
• Availability Impact: None

SquirrelMail Project

• Autocomplete versions prior to 3.0

An arbitrary script may be executed on the user's web browser.

[Update the software]
Update to the latest version according to the information provided by the developer.

SquirrelMail Project

• SquirrelMail : Plugins - Autocomplete

1. Cross-site Scripting(CWE-79) [IPA Evaluation]

1. CVE-2012-0323

1. JVN : JVN#56653852
2. National Vulnerability Database (NVD) : CVE-2012-0323

[2012/03/09]
  Web page was published