Every CVE Search/ Get API key

CVE-2019-12970

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper...

6.1 MediumFix available

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.82%Up 0.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.

Record
CVE-2019-12970
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.

Record
CVE-2019-12970
Updated
2026-11-02
EUVDEUVD-2019-4545 No score

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.

Record
EUVD-2019-4545
Updated
2026-11-03
GitHub AdvisoriesGHSA-mc9j-h3qj-qfr9 6.1

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper...

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.

Record
GHSA-mc9j-h3qj-qfr9
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2019-12970 6.1

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.

Record
UBUNTU-CVE-2019-12970
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2021-0010 No score

Updated squirrelmail packages fix security vulnerabilities

XSS was discovered in SquirrelMail through 1.4.22. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element ().

An unsafe use of unserialize() in compose.php has also been fixed.

Record
MGASA-2021-0010
Updated
2026-11-02
OSVUSN-4669-1 No score

squirrelmail vulnerability

It was discovered that a cross-site scripting (XSS) vulnerability in SquirrelMail allows remote attackers to use malicious script content from HTML e-mail to execute code and/or provoke a denial of service.

Record
USN-4669-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
squirrelmail
Debian:8
 before 2:1.4.23~svn20120406-2+deb8u4, plus listed versions
2:1.4.23~svn20120406-22:1.4.23~svn20120406-2+deb8u12:1.4.23~svn20120406-2+deb8u22:1.4.23~svn20120406-2+deb8u3
2:1.4.23~svn20120406-2+deb8u4
squirrelmail
Mageia:7
 before 1.4.23-0.svn20201220_0200.1.mga7
1.4.23-0.svn20201220_0200.1.mga7
squirrelmail
Ubuntu:Pro:14.04:LTS
 before 2:1.4.23~svn20120406-2+deb8u3ubuntu0.14.04.1~esm1, plus listed versions
2:1.4.23~svn20120406-22:1.4.23~svn20120406-2+deb8u1build0.14.04.12:1.4.23~svn20120406-2+deb8u2build0.14.04.12:1.4.23~svn20120406-2+deb8u3build0.14.04.1
2:1.4.23~svn20120406-2+deb8u3ubuntu0.14.04.1~esm1
squirrelmail
Ubuntu:16.04:LTS
 before 2:1.4.23~svn20120406-2+deb8u3ubuntu0.16.04.2, plus listed versions
2:1.4.23~svn20120406-22:1.4.23~svn20120406-2ubuntu12:1.4.23~svn20120406-2ubuntu1.16.04.12:1.4.23~svn20120406-2+deb8u1ubuntu0.16.04.12:1.4.23~svn20120406-2+deb8u2build0.16.04.12:1.4.23~svn20120406-2+deb8u2ubuntu0.16.04.22:1.4.23~svn20120406-2+deb8u2ubuntu0.16.04.32:1.4.23~svn20120406-2+deb8u3ubuntu0.16.04.1
2:1.4.23~svn20120406-2+deb8u3ubuntu0.16.04.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-12970 is a medium vulnerability (CVSS 6.1) in Squirrelmail, published July 1, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. Fixed in squirrelmail 2:1.4.23~svn20120406-2+deb8u4.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open