CSRF in all SquirrelMail forms

A few days ago, SquirrelMail announced an cross-site request forgery issue in all forms and versions below 1.4.20RC1 with the following text:

"All form submissions (send message, change preferences, etc.) in
SquirrelMail were previously subject to cross-site request forgery
(CSRF), wherein data could be sent to them from an offsite location,
which could allow an attacker to inject malicious content into user
preferences or possibly send emails without user consent."

To prevent your server from attacks, please use the updated SquirrelMail package for ispCP Omega. We recommend to update your SquirrelMail soon.

The original announcement can be found in the SquirrelMail homepage.


All ispCP Omega packages are not updated with the latest SquirrelMail. Please download the SquirrelMail Package and replace the installed SquireMail from ispCP Omega 1.0.0.

An installation instruction can be found in our Forum.