CVE-2019-12970

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2

published July 1, 2019

CVSS
—
EPSS
2%
Percentile
78.6
In the wild
Unconfirmed
What it is

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01819 · 78.6th percentile
Published
2019-07-01T10:32Z
EPSS history
Timeline
  • 01 JUL 10:32Z
    XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2
    cvelistv5