CVE-2009-0030

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-21 · updated 2026-06-16
Weakness: CWE-287

Description

A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.

Affected products

SquirrelMail: 1.4.8

References

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://secunia.com/advisories/33611
http://securitytracker.com/id?1021611
http://www.securityfocus.com/bid/33354
https://bugzilla.redhat.com/show_bug.cgi?id=480224
https://bugzilla.redhat.com/show_bug.cgi?id=480488
https://exchange.xforce.ibmcloud.com/vulnerabilities/48115
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10366
https://rhn.redhat.com/errata/RHSA-2009-0057.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://secunia.com/advisories/33611
http://securitytracker.com/id?1021611

Get alerted when CVE-2009-0030 or the next vulnerability affects your stack