Vulnerability Name:

CVE-2006-3174 (CCN-26941)

Assigned:2006-06-06
Published:2006-06-06
Updated:2017-07-20
Summary:Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter.
CVSS v3 Severity:3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:2.6 Low (CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
2.2 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)
2.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2006-3174

Source: CCN
Type: Apple Security Update 2007-007
About Security Update 2007-007

Source: CONFIRM
Type: UNKNOWN
http://docs.info.apple.com/article.html?artnum=306172

Source: CCN
Type: Apple Web site
Apple security updates

Source: APPLE
Type: UNKNOWN
APPLE-SA-2007-07-31

Source: CCN
Type: UNSECURED SYSTEMS June 06, 2006
SquirrelMail <=1.5.1 XSS vuln.

Source: MISC
Type: UNKNOWN
http://pridels0.blogspot.com/2006/06/squirrelmail-151-xss-vuln.html

Source: CCN
Type: SA26235
Mac OS X Security Update Fixes Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
26235

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:147

Source: OSVDB
Type: UNKNOWN
26610

Source: CCN
Type: OSVDB ID: 26610
SquirrelMail search.php mailbox Parameter XSS

Source: BID
Type: UNKNOWN
18700

Source: CCN
Type: BID-18700
SquirrelMail Search.PHP Cross-Site Scripting Vulnerability

Source: BID
Type: UNKNOWN
25159

Source: CCN
Type: BID-25159
Apple Mac OS X 2007-007 Multiple Security Vulnerabilities

Source: CCN
Type: SquirrelMail Web site
SquirrelMail - Webmail for Nuts!

Source: VUPEN
Type: UNKNOWN
ADV-2007-2732

Source: XF
Type: UNKNOWN
squirrelmail-search-xss(26941)

Source: XF
Type: UNKNOWN
squirrelmail-search-xss(26941)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:* (Version <= 1.5.1)

    • * Denotes that component is vulnerable
    BACK
    squirrelmail squirrelmail *