PT-2002-1258 · Horde · Imp+1

Publicado 2002-04-22 · Atualizado 2016-10-18 · CVE-2002-0181

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IMP version 2.2.8 HORDE version 1.2.7

Description A cross-site scripting issue allows remote attackers to execute arbitrary web script and steal cookies of other users via the script parameter in the "status.php3" file.

Recommendations For IMP version 2.2.8, update to a version that fixes this issue. For HORDE version 1.2.7, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the "status.php3" file until a patch is available. Avoid using the script parameter in the affected API endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2002-0181

Produtos afetados

Horde

Imp

Referências · 10

• http://marc.info/?l=bugtraq&m=101828033830744&w=2 · Nota
• http://bugs.horde.org/show_bug.cgi?id=916 · Nota
• http://debian.org/security/2002/dsa-126 · Aviso do Fabricante
• http://osvdb.org/5345 · Nota
• http://iss.net/security_center/static/8769.php · Nota
• http://securityfocus.com/bid/4444 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0181 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0181 · Nota de Segurança
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000473 · Aviso do Fabricante
• http://calderasystems.com/support/security/advisories/CSSA-2002-016.1.txt · Aviso do Fabricante