Home > Vulnerability Database > CVE-2009-2964

Mend.io Vulnerability Database

CVE-2009-2964

Date: August 25, 2009

Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.

Severity Score

5.6

Related Resources (33)

Url: http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002207.html

Url: http://www.vupen.com/english/advisories/2009/3315

Url: http://www.vupen.com/english/advisories/2010/1481

Url: http://osvdb.org/60469

Url: https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00954.html

Url: http://www.vupen.com/english/advisories/2009/2262

Url: https://nvd.nist.gov/vuln/detail/CVE-2009-2964

Url: http://support.apple.com/kb/HT4188

Url: http://download.gna.org/nasmail/nasmail-1.7.zip

Url: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543818

Url: https://access.redhat.com/security/cve/CVE-2009-2964

Url: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2009:222

Url: http://www.vupen.com/english/advisories/2010/2080

Url: http://jvn.jp/en/jp/JVN30881447/index.html

Url: http://secunia.com/advisories/37415

Url: http://secunia.com/advisories/34627

Url: http://www.securityfocus.com/bid/36196

Url: http://secunia.com/advisories/36363

Url: http://www.osvdb.org/57001

Url: http://www.squirrelmail.org/security/issue/2009-08-12

Url: http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html

Url: http://www.debian.org/security/2010/dsa-2091

Url: https://bugzilla.redhat.com/show_bug.cgi?id=517312

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2009-2964

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/52406

Url: https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00927.html

Url: https://gna.org/forum/forum.php?forum_id=2146

Url: http://secunia.com/advisories/40964

Url: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog?revision=13818&view=markup&pathrev=13818

Url: http://secunia.com/advisories/40220

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10668

Url: https://www.mend.io/vulnerability-database/CVE-2009-2964

Severity Score

5.6

Weakness Type (CWE)

Cross-Site Request Forgery (CSRF)

CWE-352

CVSS v3.1

Base Score:	5.6
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	6.8
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2009-2964

Date: August 25, 2009

Severity Score

Related Resources (33)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?