What’s Vulnerable › Vulnerabilities

CVE-2009-1580

• Severity: medium (CVSS 5.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-05-14 · updated 2026-06-16
• Weakness: CWE-287

Description

Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie.

Affected products

• SquirrelMail: through 1.4.17; 0.1, 0.1.1, 0.1.2, 0.2, 0.2.1, 0.3 (+65)

References

• http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html
• http://secunia.com/advisories/35052
• http://secunia.com/advisories/35073
• http://secunia.com/advisories/35140
• http://secunia.com/advisories/40220
• http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog
• http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13676
• http://support.apple.com/kb/HT4188
• http://www.debian.org/security/2009/dsa-1802
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:110
• http://www.securityfocus.com/bid/34916
• http://www.squirrelmail.org/security/issue/2009-05-11

Get alerted when CVE-2009-1580 or the next vulnerability affects your stack