PT-2007-2867 · Horde · Horde Framework

Publicado 2007-03-16 · Atualizado 2018-10-16 · CVE-2007-1473

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Horde Framework versions prior to 3.1.4 RC1

Description The issue is related to a cross-site scripting (XSS) vulnerability. It occurs when the login page contains a language selection box, allowing remote attackers to inject arbitrary web script or HTML via the new lang parameter to the "login.php" endpoint.

Recommendations For versions prior to 3.1.4 RC1, update to version 3.1.4 RC1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "login.php" endpoint or disabling the language selection box until a patch is applied. Avoid using the new lang parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-1473

DSA-1406-1

Produtos afetados

Horde Framework

Referências · 16

• 🔥 https://exploit-db.com/exploits/29745 · Exploit
• http://secunia.com/advisories/27565 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33013 · Nota
• http://vupen.com/english/advisories/2007/0965 · Nota
• http://securityfocus.com/bid/22984 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1473 · Nota
• http://secunia.com/advisories/24528 · Nota
• http://novell.com/linux/security/advisories/2007_007_suse.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-1473 · Nota de Segurança
• http://osvdb.org/33084 · Nota
• http://lists.horde.org/archives/announce/2007/000315.html · Aviso do Fabricante
• http://securitytracker.com/id?1017775 · Nota
• http://debian.org/security/2007/dsa-1406 · Aviso do Fabricante
• http://securityfocus.com/archive/1/462915/100/0/threaded · Nota
• http://securityreason.com/securityalert/2427 · Nota