Skip to main content

CVE-2020-14933 squirrelmail: use of unserialize function for the attachments value in compose.php

Publication Date 2020-06-20
Severity Low
Type Cross-Site Request Forgery
Affected PHP Versions
Fixed Product Versions

CVE Details

compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. An unsafe deserialization vulnerability was found in SquirrelMail. This flaw allows an authenticated user to craft malicious form data when submitting mail.

Recommendations

555