PT-2008-3496 · Horde · Egroupware+2

Publicado

2008-04-27

·

Atualizado

2018-10-11

·

CVE-2008-1974

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Horde Kronolith version 2.1.7 Groupware Webmail Edition version 1.0.6 Groupware version 1.0.5
Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the url parameter in the addevent.php file. This could potentially lead to unauthorized actions on behalf of the user.
Recommendations For Horde Kronolith version 2.1.7, update the addevent.php file to properly sanitize the url parameter. For Groupware Webmail Edition version 1.0.6, restrict access to the addevent.php file until a fix is applied. For Groupware version 1.0.5, avoid using the url parameter in the addevent.php file until the issue is resolved.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-1974
DSA-1560-1

Produtos afetados

Egroupware
Groupware Webmail Edition
Horde Kronolith