CVE-2009-2964
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier,...
CVE-2009-2964 is a medium vulnerability (CVSS 6.8) in Squirrelmail, published August 25, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in squirrelmail 0:1.4.8-16.el3.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 1.52%EPSS, 74th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0:1.4.8-16.el3squirrelmail +10 more
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squirrelmailDebian:5.0 From an advisory covering 2 CVEs | before 2:1.4.15-4+lenny3.1, plus listed versions 2:1.4.15-42:1.4.15-4+lenny12:1.4.15-4+lenny2 | 2:1.4.15-4+lenny3.1 |
squirrelmailRed Hat:enterprise_linux:3::as | before 0:1.4.8-16.el3 | 0:1.4.8-16.el3 |
squirrelmailRed Hat:enterprise_linux:3::desktop | before 0:1.4.8-16.el3 | 0:1.4.8-16.el3 |
squirrelmailRed Hat:enterprise_linux:3::es | before 0:1.4.8-16.el3 | 0:1.4.8-16.el3 |
squirrelmailRed Hat:enterprise_linux:3::ws | before 0:1.4.8-16.el3 | 0:1.4.8-16.el3 |
squirrelmailRed Hat:enterprise_linux:4::as | before 0:1.4.8-5.el4_8.8 | 0:1.4.8-5.el4_8.8 |
squirrelmailRed Hat:enterprise_linux:4::desktop | before 0:1.4.8-5.el4_8.8 | 0:1.4.8-5.el4_8.8 |
squirrelmailRed Hat:enterprise_linux:4::es | before 0:1.4.8-5.el4_8.8 | 0:1.4.8-5.el4_8.8 |
squirrelmailRed Hat:enterprise_linux:4::ws | before 0:1.4.8-5.el4_8.8 | 0:1.4.8-5.el4_8.8 |
squirrelmailRed Hat:enterprise_linux:5::client_workstation | before 0:1.4.8-5.el5_4.10 | 0:1.4.8-5.el5_4.10 |
squirrelmailRed Hat:enterprise_linux:5::server | before 0:1.4.8-5.el5_4.10 | 0:1.4.8-5.el5_4.10 |
What each source reports
NVD Score used
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.
- Record
CVE-2009-2964- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE ListNo score
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.
- Record
CVE-2009-2964- Updated
- 2026-11-02
EUVDEUVD-2009-2950No score
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.
- Record
EUVD-2009-2950- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jj6p-27w9-hh6mNo score
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier,...
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.
- Record
GHSA-jj6p-27w9-hh6m- Weakness
- CWE-352
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apple.com/archives/security-announce/2010//Jun/msg00001.html
redhat.com/archives/fedora-package-announce/2009-August/msg00954.html
gna.org/forum/forum.php?forum_id=2146
vupen.com/english/advisories/2010/1481
download.gna.org/nasmail/nasmail-1.7.zip
squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818
Show 30 moreShow less
jvn.jp/en/jp/JVN30881447/index.html
secunia.com/advisories/34627
bugs.debian.org/cgi-bin/bugreport.cgi?bug=543818
debian.org/security/2010/dsa-2091
bugzilla.redhat.com/show_bug.cgi?id=517312
mandriva.com/security/advisories?name=MDVSA-2009:222
support.apple.com/kb/HT4188
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10668
osvdb.org/60469
exchange.xforce.ibmcloud.com/vulnerabilities/52406
securityfocus.com/bid/36196
squirrelmail.org/security/issue/2009-08-12
osvdb.org/57001
jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002207.html
nvd.nist.gov/vuln/detail/CVE-2009-2964
github.com/advisories/GHSA-jj6p-27w9-hh6m
access.redhat.com/errata/RHSA-2009:1490
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1490.json
cve.org/CVERecord?id=CVE-2009-2964