CVE-2020-14932: 
Linux Ubuntu vulnerability analysis and mitigation

compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This vulnerability, identified as CVE-2020-14932, was disclosed on June 20, 2020. The issue affects the mailto.php functionality in SquirrelMail and represents a potential security risk due to the unsafe handling of user-controlled data (OSS Security).

The vulnerability stems from the use of PHP's unserialize() function on untrusted user data received through GET parameters. The $mailtodata variable, which is processed by unserialize(), is directly controlled by user input through the mailto.php script that handles mail composition interface. The CVSS v3.1 base score for this vulnerability is 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD).

While the vulnerability involves unsafe deserialization, the actual impact appears to be limited. According to security researchers, there are no immediately exploitable code paths that would lead to code execution using this method. However, if the underlying PHP version is also vulnerable to certain deserialization flaws (such as CVE-2017-5340), the impact could potentially be more severe (AttackerKB).

The exploitability of this vulnerability is considered Very Low. While the vulnerability exists in the default configuration, security researchers note that there is no clear sequence of code that can be exploited to gain code execution using this method. The exploitation would require additional vulnerable code paths or magic methods that could process the deserialized data in a dangerous way (AttackerKB).

A patch has been created to convert the vulnerable code to use json_encode/json_decode instead of unserialize(). However, at the time of the vulnerability disclosure, no official patch was available from the SquirrelMail developers. Third-party patches have been made available through community efforts (OSS Security).