CVE-2009-2964
Summary
| CVE | CVE-2009-2964 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-08-25 17:30:01 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Squirrelmail | Squirrelmail | 0.1.1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 0.1.2 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.0 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.0.1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.0.2 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.0.3 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.0.4 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.0.5 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.0.6 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.0pre1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.0pre2 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.0pre3 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.1.0 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.1.1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.1.2 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.1.3 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.0 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.0 | rc3 | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.0_rc3 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.10 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.11 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.2 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.3 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.4 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.5 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.6 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.6-rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.7 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.8 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.2.9 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.3.0 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.3.1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.3.2 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4 | rc1 | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.0 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.0 | rc1 | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.0 | rc2a | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.0-r1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.0_rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.0_rc2a | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.10 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.10a | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.11 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.12 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.13 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.15 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.15 | rc1 | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.15rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.15_rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.16 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.17 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.18 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.2 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.2-r1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.2-r2 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.2-r3 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.2-r4 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.2-r5 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3 | r3 | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3 | rc1 | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3a | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3aa | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3_r3 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3_rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.3_rc1 | r1 | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.4 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.4 | rc1 | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.4_rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.5 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.5_rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.6 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.6 | rc1 | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.6_cvs | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.6_rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.7 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.8 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.8.4fc6 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.9 | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4.9a | All | All | All |
| Application | Squirrelmail | Squirrelmail | 1.4_rc1 | All | All | All |
| Application | Squirrelmail | Squirrelmail | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Fedora update for squirrelmail - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| download.gna.org/nasmail/nasmail-1.7.zip | af854a3a-2127-422b-91ae-364da2661108 | download.gna.org | |
| SquirrelMail Cross-Site Request Forgery Vulnerability - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| 404 Not Found | af854a3a-2127-422b-91ae-364da2661108 | squirrelmail.svn.sourceforge.net | Patch |
| Debian -- Security Information -- DSA-2091-1 squirrelmail | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Apple Mac OS X Security Update Fixes Multiple Vulnerabilities - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| SquirrelMail Form Submissions Cross Site Request Forgery Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| NaSMail Cross-Site Scripting and Request Forgery Vulnerabilities - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| [SECURITY] Fedora 11 Update: squirrelmail-1.4.19-2.fc11 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| www.osvdb.org/57001 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| JVN#30881447: SquirrelMail vulnerable to cross-site request forgery | af854a3a-2127-422b-91ae-364da2661108 | jvn.jp | |
| Support / Security / Advisories / / MDVSA-2009:222 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002207.html | af854a3a-2127-422b-91ae-364da2661108 | jvndb.jvn.jp | |
| osvdb.org/60469 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| SquirrelMail - Webmail for Nuts! | af854a3a-2127-422b-91ae-364da2661108 | www.squirrelmail.org | Patch, Vendor Advisory |
| #543818 - CVE-2009-2964: Multiple cross-site request forgery (CSRF) vulnerabilities - Debian Bug report logs | af854a3a-2127-422b-91ae-364da2661108 | bugs.debian.org | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Patch, Vendor Advisory |
| About the security content of Security Update 2010-004 / Mac OS X v10.6.4 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | |
| 517312 – (CVE-2009-2964) CVE-2009-2964 squirrelmail: CSRF issues in all forms | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Patch |
| NaSMail - News: NaSMail v.1.7 released [Gna!] | af854a3a-2127-422b-91ae-364da2661108 | gna.org | |
| Debian update for squirrelmail - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| 404 Not Found | af854a3a-2127-422b-91ae-364da2661108 | squirrelmail.svn.sourceforge.net | Patch |
| [SECURITY] Fedora 10 Update: squirrelmail-1.4.19-2.fc10 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| APPLE-SA-2010-06-15-1 Security Update 2010-004 / Mac OS X v10.6.4 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.