CVE-2006-6142

Description

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."

6.8

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 3.26% Top 15%

Vendor Advisory mandriva.com Vendor Advisory apple.com Vendor Advisory redhat.com Vendor Advisory fedoranews.org Vendor Advisory novell.com Vendor Advisory debian.org Vendor Advisory fedoranews.org Vendor Advisory sgi.com Vendor Advisory novell.com

Affected: n/a n/a

References

Link	Tags
http://www.vupen.com/english/advisories/2007/2732	vdb entry
http://www.mandriva.com/security/advisories?name=MDKSA-2006:226	vendor advisory
http://secunia.com/advisories/23195	third party advisory
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html	vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-0022.html	vendor advisory
http://fedoranews.org/cms/node/2438	vendor advisory
http://secunia.com/advisories/23409	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9988	signature vdb entry
http://secunia.com/advisories/23504	third party advisory
http://secunia.com/advisories/24284	third party advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30693	vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/30695	vdb entry
http://secunia.com/advisories/23322	third party advisory
http://www.novell.com/linux/security/advisories/2007_4_sr.html	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30694	vdb entry
http://www.debian.org/security/2006/dsa-1241	vendor advisory
http://fedoranews.org/cms/node/2439	vendor advisory
http://www.securityfocus.com/bid/21414	vdb entry
http://docs.info.apple.com/article.html?artnum=306172
http://sourceforge.net/project/shownotes.php?release_id=468482
http://secunia.com/advisories/24004	third party advisory
http://www.securityfocus.com/bid/25159	vdb entry
ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc	vendor advisory
http://squirrelmail.org/security/issue/2006-12-02
http://www.novell.com/linux/security/advisories/2006_29_sr.html	vendor advisory
https://issues.rpath.com/browse/RPL-849
http://www.vupen.com/english/advisories/2006/4828	vdb entry
http://secunia.com/advisories/23811	third party advisory
http://securitytracker.com/id?1017327	vdb entry
http://secunia.com/advisories/26235	third party advisory

Frequently Asked Questions

What is the severity of CVE-2006-6142?: CVE-2006-6142 has been scored as a medium severity vulnerability.
How to fix CVE-2006-6142?: To fix CVE-2006-6142, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-6142 being actively exploited in the wild?: It is possible that CVE-2006-6142 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~3% probability that this vulnerability will be exploited by malicious actors in the next 30 days.