Popoon · Popoon · CVE-2008-3824
**Name of the Vulnerable Software and Affected Versions**
Horde versions 3.1.x through 3.1.8
Horde versions 3.2.x through 3.2.1
Popoon version r22196 and earlier
**Description**
A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by using / (slash) characters as replacements for spaces in an HTML e-mail message. This occurs due to insufficient input validation in the Text Filter/Filter/xss.php file in Horde and the externalinput.php file in Popoon.
**Recommendations**
For Horde versions 3.1.x through 3.1.8, update to version 3.1.9 or later.
For Horde versions 3.2.x through 3.2.1, update to version 3.2.2 or later.
For Popoon version r22196 and earlier, update to a version later than r22196.