PT-2002-1258 · Horde · Imp+1

Published 2002-04-22 · Updated 2016-10-18 · CVE-2002-0181

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IMP version 2.2.8 HORDE version 1.2.7

Description A cross-site scripting issue allows remote attackers to execute arbitrary web script and steal cookies of other users via the script parameter in the "status.php3" file.

Recommendations For IMP version 2.2.8, update to a version that fixes this issue. For HORDE version 1.2.7, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the "status.php3" file until a patch is available. Avoid using the script parameter in the affected API endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2002-0181

Affected Products

Horde

Imp

References · 10

• http://debian.org/security/2002/dsa-126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0181 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000473 · Vendor Advisory
• http://calderasystems.com/support/security/advisories/CSSA-2002-016.1.txt · Vendor Advisory
• http://marc.info/?l=bugtraq&m=101828033830744&w=2 · Note
• http://bugs.horde.org/show_bug.cgi?id=916 · Note
• http://osvdb.org/5345 · Note
• http://iss.net/security_center/static/8769.php · Note
• http://securityfocus.com/bid/4444 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0181 · Note