PT-2011-1432 · Horde · Horde Imp+1

Publicado

2011-03-31

·

Atualizado

2019-06-18

·

CVE-2010-3695

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Horde IMP versions prior to 4.3.8 Horde Groupware Webmail Edition versions prior to 1.2.7
Description The issue allows remote attackers to inject arbitrary web script or HTML via the fm id parameter in a "fetchmail prefs save" action, related to the Fetchmail configuration. This is a cross-site scripting (XSS) issue.
Recommendations For Horde IMP versions prior to 4.3.8, update to version 4.3.8 or later. For Horde Groupware Webmail Edition versions prior to 1.2.7, update to version 1.2.7 or later. As a temporary workaround, consider restricting access to the fetchmailprefs.php file until a patch is available. Avoid using the fm id parameter in the affected action until the issue is resolved.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-3695
DSA-2204-1

Produtos afetados

Horde Groupware Webmail Edition
Horde Imp