Unrated severityNVD Advisory· Published Jan 21, 2009· Updated Apr 23, 2026
CVE-2009-0030
CVE-2009-0030
Description
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
Affected products
1- cpe:2.3:a:squirrelmail:squirrelmail:1.4.8:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
9- secunia.com/advisories/33611nvdVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.htmlnvd
- securitytracker.com/idnvd
- www.securityfocus.com/bid/33354nvd
- bugzilla.redhat.com/show_bug.cginvd
- bugzilla.redhat.com/show_bug.cginvd
- exchange.xforce.ibmcloud.com/vulnerabilities/48115nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10366nvd
- rhn.redhat.com/errata/RHSA-2009-0057.htmlnvd
News mentions
0No linked articles in our index yet.