PT-2004-3630 · Horde · Horde Application Framework

Published 2004-12-31 · Updated 2017-07-29 · CVE-2004-2741

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Horde Application Framework version 2.2.6

Description The issue is related to a cross-site scripting (XSS) vulnerability in the "help window" (help.php) that allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the module, topic, or module parameters.

Recommendations For Horde Application Framework version 2.2.6, consider disabling the "help window" (help.php) until a patch is available to prevent exploitation. Restrict access to the vulnerable parameters module, topic, to minimize the risk of XSS attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2004-2741

Affected Products

Horde Application Framework

References · 8

• http://secunia.com/advisories/12992 · Vendor Advisory
• http://lists.horde.org/archives/announce/2004/000107.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-2741 · Security Note
• http://securityfocus.com/bid/11546 · Note
• http://cvs.horde.org/diff.php/horde/templates/help/index.inc?r1=1.9.2.4&r2=1.9.2.5&ty=u · Note
• http://osvdb.org/11164 · Note
• http://securitytracker.com/id?1011959 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17881 · Note