CVE-2020-14933 - squirrelmail: use of unserialize function for the attachments value in compose.php

Back Back to CVE browser

HIGH

squirrelmail: use of unserialize function for the attachments value in compose.php

Published Jun 20, 2020

8.8

HIGH

CVSS 3.1

EPSS 1.42%

Description

compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. NOTE: the vendor disputes this because these two conditions for PHP object injection are not satisfied: existence of a PHP magic method (such as __wakeup or __destruct), and any attack-relevant classes must be declared before unserialize is called (or must be autoloaded).

Affected products

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	squirrelmail	Out of support scope	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-502

Deserialization of Untrusted Data

CWE-676

References (6)

https://access.redhat.com/security/cve/CVE-2020-14933
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1850184
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7069
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-14933
https://www.cve.org/CVERecord?id=CVE-2020-14933
https://www.openwall.com/lists/oss-security/2020/06/20/1
x_refsource_MISCMailing ListThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2020-14933		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1850184		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7069		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-14933
https://www.cve.org/CVERecord?id=CVE-2020-14933
https://www.openwall.com/lists/oss-security/2020/06/20/1		x_refsource_MISCMailing ListThird Party Advisory