CVE-2004-0519

EPSS 22.5%

Vexday Risk Score

43Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 22.5%KEV nãoPoC públicaNuclei simMetasploit —Patch referenciado

Lifecycle

30 Apr 2004Public PoC

03 Jun 2004Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/24068unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

ftp://patches.sgi.com/support/free/security/advisories/20040604-01-U.asc http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000858 http://marc.info/?l=bugtraq&m=108334862800260 http://rhn.redhat.com/errata/RHSA-2004-240.html https://bugzilla.fedora.us/show_bug.cgi?id=1733 http://secunia.com/advisories/11531 http://secunia.com/advisories/11686 http://secunia.com/advisories/11870 http://secunia.com/advisories/12289 http://security.gentoo.org/glsa/glsa-200405-16.xml https://exchange.xforce.ibmcloud.com/vulnerabilities/16025 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1006