CVE-2002-1648: Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote a...

Security readout for executives and security teams

This old SquirrelMail flaw lets an attacker trick a logged-in user’s browser into sending an email from that user’s account. The public bundle identifies affected SquirrelMail versions as before 1.2.3. Business impact is mainly impersonation, phishing, and abuse of trusted internal email identity. Exposure is likely limited to legacy SquirrelMail deployments earlier than 1.2.3, especially internet-accessible webmail. Organizations without SquirrelMail, or running newer versions, are not indicated as affected by the supplied sources. Treat this as a legacy exposure check rather than an emergency unless vulnerable SquirrelMail is still reachable. If present, prioritize remediation because account impersonation through trusted email can support fraud, phishing, and internal compromise. Mitigation focus: Inventory any SquirrelMail deployments and confirm exact versions.; Upgrade SquirrelMail installations earlier than 1.2.3 per vendor guidance.; Restrict access to legacy webmail until version status is verified..

Prepared

Jun 29, 2026, 22:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.