CVE-2004-0520

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-08-18 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using read_body.php.

Affected products

Open Webmail: 2.30, 2.31, 2.32
Sgi Propack: 3.0
SquirrelMail: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5 (+11)

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000858
http://marc.info/?l=bugtraq&m=108611554415078&w=2
http://marc.info/?l=squirrelmail-cvs&m=108532891231712
http://rhn.redhat.com/errata/RHSA-2004-240.html
http://secunia.com/advisories/11870
http://secunia.com/advisories/12289
http://www.debian.org/security/2004/dsa-535
http://www.gentoo.org/security/en/glsa/glsa-200406-08.xml
http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt
http://www.securityfocus.com/advisories/6827
http://www.securityfocus.com/bid/10439

Get alerted when CVE-2004-0520 or the next vulnerability affects your stack