CVE-2006-0377 Command injection in n/a
Remote attackers can inject arbitrary IMAP commands via the mailbox parameter, potentially leading to code execution or data access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-0377?
CVE-2006-0377 is a medium-severity command injection vulnerability in Squirrelmail Squirrelmail, published on 24 Feb 2006. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP injection."
Which versions are affected by CVE-2006-0377?
It affects 1 product.
Products include Squirrelmail Squirrelmail.
How do I fix CVE-2006-0377?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2006-0377 being exploited?
There is no known exploitation of CVE-2006-0377 in the wild and no public exploit code.
Other vulnerabilities in Squirrelmail Squirrelmail
Sources
Also known as GHSA-3j45-pgff-92h5.