PatchTheCVEsquirrelmail vulnerabilities
Recent CVEs affecting squirrelmail products. 3 tracked.
squirrelmail has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2020-06-20. Highest priority: CVE-2020-14932 (score 58/100).
- CVE-2020-14933 HIGH 8.8 DOWNGRADE compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP
- CVE-2020-14932 CRITICAL 9.8 DOWNGRADE compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP
- CVE-2012-5623 HIGH 7.5 DOWNGRADE Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords.
FAQ
How do I fix squirrelmail vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is squirrelmail being exploited right now?
None of the tracked squirrelmail CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which squirrelmail CVE should I patch first?
CVE-2020-14932 currently ranks highest (58/100): compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP .