CVE-2009-0030
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all...
CVE-2009-0030 is a medium vulnerability (CVSS 6.5) in Squirrelmail, published January 21, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.68%, the 77th percentile. No source names a fixed version.
- Severity
- 6.5 MediumCVSS 2.0, NVD
- Exploit chance
- 1.68%EPSS, 77th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squirrelmailRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs | before 0:1.4.8-9.el3 | 0:1.4.8-9.el3 |
squirrelmailRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs | before 0:1.4.8-9.el3 | 0:1.4.8-9.el3 |
squirrelmailRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs | before 0:1.4.8-9.el3 | 0:1.4.8-9.el3 |
squirrelmailRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs | before 0:1.4.8-9.el3 | 0:1.4.8-9.el3 |
squirrelmailRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs | before 0:1.4.8-5.el4_7.3 | 0:1.4.8-5.el4_7.3 |
squirrelmailRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs | before 0:1.4.8-5.el4_7.3 | 0:1.4.8-5.el4_7.3 |
squirrelmailRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs | before 0:1.4.8-5.el4_7.3 | 0:1.4.8-5.el4_7.3 |
squirrelmailRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs | before 0:1.4.8-5.el4_7.3 | 0:1.4.8-5.el4_7.3 |
squirrelmailRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:1.4.8-5.el5_2.3 | 0:1.4.8-5.el5_2.3 |
squirrelmailRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.4.8-5.el5_2.3 | 0:1.4.8-5.el5_2.3 |
What each source reports
NVD Score used
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
- Record
CVE-2009-0030- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE ListNo score
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
- Record
CVE-2009-0030- Updated
- 2026-11-02
EUVDEUVD-2009-0042No score
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
- Record
EUVD-2009-0042- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8r42-w2m4-wwh4No score
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all...
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
- Record
GHSA-8r42-w2m4-wwh4- Weakness
- CWE-287
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rhn.redhat.com/errata/RHSA-2009-0057.html
secunia.com/advisories/33611
bugzilla.redhat.com/show_bug.cgi?id=480488
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10366
exchange.xforce.ibmcloud.com/vulnerabilities/48115
Show 14 moreShow less
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
securitytracker.com/id?1021611
securityfocus.com/bid/33354
nvd.nist.gov/vuln/detail/CVE-2009-0030
github.com/advisories/GHSA-8r42-w2m4-wwh4
access.redhat.com/errata/RHSA-2009:0057
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0057.json
cve.org/CVERecord?id=CVE-2009-0030