Main Vulnerability Database SB2020062002

SB2020062002 - Multiple vulnerabilities in SquirrelMail

Published: June 20, 2020 Updated: August 8, 2020

Security Bulletin ID SB2020062002

Severity

High

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Deserialization of Untrusted Data (CVE-ID: CVE-2020-14932)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php.

2) Deserialization of Untrusted Data (CVE-ID: CVE-2020-14933)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request.

Remediation

Install update from vendor's website.

References

https://www.openwall.com/lists/oss-security/2020/06/20/1