CVE-2020-14932

CVE-2020-14932 squirrelmail: use of unserialize function for the mailtodata value in compose.php

Publication Date2020-06-20
SeverityLow
TypeCross-Site Request Forgery
Affected PHP Versions
    Fixed Product Versions

      CVE Details

      compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php. An unsafe deserialization vulnerability was found in SquirrelMail. This flaw allows an authenticated user to craft malicious form data when submitting mail.

      Recommendations

      555