CVE-2008-2379
Description
Cross-site scripting (XSS) vulnerability in SquirrelMail before 1.4.17 allows remote attackers to inject arbitrary web script or HTML via a crafted hyperlink in an HTML part of an e-mail message.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
SquirrelMail before 1.4.17 is vulnerable to XSS via a crafted hyperlink in an HTML email part.
Vulnerability
A cross-site scripting (XSS) vulnerability exists in SquirrelMail versions prior to 1.4.17 [1][2]. The flaw occurs when the application processes HTML parts of incoming email messages; a remote attacker can craft a hyperlink with malicious script content that, when viewed by a user, executes within the security context of the SquirrelMail webmail client [1][2].
Exploitation
An attacker sends an email to the victim containing an HTML part with a specially crafted hyperlink [1][2]. The victim must view the HTML part of the message using SquirrelMail; no additional user interaction beyond reading the email is required for the script to execute [1][2].
Impact
Successful exploitation allows the attacker to inject arbitrary web script or HTML, leading to actions such as session hijacking, credential theft, or defacement within the victim's webmail session [1][2]. The attacker's script runs with the same access as the authenticated SquirrelMail user.
Mitigation
Upgrade to SquirrelMail version 1.4.17 or later [1][2]. Apple also addressed this issue in Security Update 2009-001 for affected Apple products that included SquirrelMail [1]. No workaround is documented other than applying the available patch.
AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
67cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*+ 66 more
- cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*range: <=1.4.16
- cpe:2.3:a:squirrelmail:squirrelmail:0.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.4pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.4pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.5pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.5pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0pre3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.0_rc3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.0_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.0_rc2a:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.10a:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.15_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.4_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.5_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.9a:*:*:*:*:*:*:*
- (no CPE)range: <1.4.17
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
16- secunia.com/advisories/32143nvdVendor Advisory
- lists.apple.com/archives/security-announce/2009/Feb/msg00000.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.htmlnvd
- secunia.com/advisories/33054nvd
- secunia.com/advisories/33071nvd
- secunia.com/advisories/33937nvd
- security-net.biz/wsw/index.phpnvd
- support.apple.com/kb/HT3438nvd
- www.debian.org/security/2008/dsa-1682nvd
- www.securityfocus.com/bid/32603nvd
- www.squirrelmail.org/index.phpnvd
- www.vupen.com/english/advisories/2008/3332nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/47024nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9764nvd
- www.redhat.com/archives/fedora-package-announce/2008-December/msg00223.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2008-December/msg00449.htmlnvd
News mentions
0No linked articles in our index yet.