CVE-2009-1578
Description
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.4.18 and NaSMail before 1.7 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) certain encrypted strings in e-mail headers, related to contrib/decrypt_headers.php; (2) PHP_SELF; and (3) the query string (aka QUERY_STRING).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
SquirrelMail before 1.4.18 and NaSMail before 1.7 contain multiple XSS flaws via encrypted email headers, PHP_SELF, and QUERY_STRING.
Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities exist in SquirrelMail versions before 1.4.18 and NaSMail before 1.7. The flaws allow attackers to inject arbitrary web script or HTML via (1) certain encrypted strings in email headers, related to contrib/decrypt_headers.php; (2) the PHP_SELF variable; and (3) the query string (QUERY_STRING). These vectors are reachable without special configuration, as they involve core input-handling routines in the webmail interface [1][2][3][4].
Exploitation
An attacker can exploit these vulnerabilities by sending a crafted email containing malicious encrypted strings in headers, or by constructing a malicious URL that manipulates PHP_SELF or the query string. No authentication is required; the attacker only needs to deliver the payload to a victim who accesses the vulnerable SquirrelMail or NaSMail interface. For the email header vector, the attacker must control the encrypted content in the header [1][2][3][4].
Impact
Successful exploitation allows the attacker to execute arbitrary HTML and JavaScript in the victim's browser within the security context of the webmail application. This can lead to session hijacking, credential theft, and other client-side attacks. The impact is limited to the scope of the user's session on the affected webmail system [1][2][3][4].
Mitigation
SquirrelMail addressed these issues in version 1.4.18. NaSMail fixed them in version 1.7. Users should upgrade to these or later versions. If an upgrade is not immediately possible, administrators should restrict access to the webmail interface and ensure no untrusted content can reach the vulnerable scripts [1][2][3][4].
AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
61cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*+ 59 more
- cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.3pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.4pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.4pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.5pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:0.5pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.0pre3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.0_rc3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.0_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.0_rc2a:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.10a:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.15:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.15_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:squirrelmail:squirrelmail:1.4.16:*:*:*:*:*:*:*
- (no CPE)range: <1.4.18
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
32- squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/contrib/decrypt_headers.phpnvdPatch
- squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLognvdPatch
- squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/global.phpnvdPatch
- squirrelmail.svn.sourceforge.net/viewvc/squirrelmailnvdPatch
- squirrelmail.svn.sourceforge.net/viewvc/squirrelmailnvdPatch
- www.securityfocus.com/bid/34916nvdPatch
- www.squirrelmail.org/security/issue/2009-05-08nvdPatchVendor Advisory
- www.squirrelmail.org/security/issue/2009-05-09nvdPatchVendor Advisory
- www.vupen.com/english/advisories/2009/1296nvdPatchVendor Advisory
- www.redhat.com/archives/fedora-package-announce/2009-May/msg00566.htmlnvdPatch
- www.redhat.com/archives/fedora-package-announce/2009-May/msg00577.htmlnvdPatch
- www.mandriva.com/security/advisoriesnvdExploitPatch
- secunia.com/advisories/35052nvdVendor Advisory
- secunia.com/advisories/35073nvdVendor Advisory
- download.gna.org/nasmail/nasmail-1.7.zipnvd
- lists.apple.com/archives/security-announce/2010//Jun/msg00001.htmlnvd
- osvdb.org/60468nvd
- secunia.com/advisories/35140nvd
- secunia.com/advisories/35259nvd
- secunia.com/advisories/37415nvd
- secunia.com/advisories/40220nvd
- support.apple.com/kb/HT4188nvd
- www.debian.org/security/2009/dsa-1802nvd
- www.redhat.com/support/errata/RHSA-2009-1066.htmlnvd
- www.vupen.com/english/advisories/2009/3315nvd
- www.vupen.com/english/advisories/2010/1481nvd
- bugzilla.redhat.com/show_bug.cginvd
- exchange.xforce.ibmcloud.com/vulnerabilities/50459nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/50460nvd
- gna.org/forum/forum.phpnvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11624nvd
- www.redhat.com/archives/fedora-package-announce/2009-May/msg00572.htmlnvd
News mentions
0No linked articles in our index yet.