PT-2008-5173 · Popoon+1 · Popoon+1

Alexios Fakos · Publicado 2008-09-12 · Atualizado 2018-10-11 · CVE-2008-3824

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Horde versions 3.1.x through 3.1.8 Horde versions 3.2.x through 3.2.1 Popoon version r22196 and earlier

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by using / (slash) characters as replacements for spaces in an HTML e-mail message. This occurs due to insufficient input validation in the Text Filter/Filter/xss.php file in Horde and the externalinput.php file in Popoon.

Recommendations For Horde versions 3.1.x through 3.1.8, update to version 3.1.9 or later. For Horde versions 3.2.x through 3.2.1, update to version 3.2.2 or later. For Popoon version r22196 and earlier, update to a version later than r22196.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-3824

DSA-1642-1

DTSA-165-1

Produtos afetados

Horde

Popoon

Referências · 18

• 🔥 https://exploit-db.com/exploits/32353 · Exploit
• 🔥 http://securityfocus.com/bid/31107 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3824 · Nota
• http://securityreason.com/securityalert/4245 · Nota
• http://marc.info/?l=horde-announce&m=122103888111491&w=2 · Correção
• http://phpmyfaq.de/advisory_2008-09-11.php · Nota
• http://openwall.com/lists/oss-security/2008/09/10/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3824 · Nota de Segurança
• http://secunia.com/advisories/31842 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2548 · Nota
• http://securityfocus.com/archive/1/496182/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45031 · Nota
• http://ocert.org/patches/2008-012/Text_Filter.patch · Correção
• http://osvdb.org/47996 · Nota
• http://marc.info/?l=horde-announce&m=122104360019867&w=2 · Nota