PT-2006-4423 · Horde · Horde Application Framework
Moritz Naumann
·
Published
2006-07-13
·
Updated
2018-10-18
·
CVE-2006-3548
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Horde Application Framework versions 3.0.0 through 3.0.10
Horde Application Framework versions 3.1.0 through 3.1.1
Description
The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several methods, including using a javascript URI or an external http, https, or ftp URI in the
url parameter in "services/go.php", a javascript URI in the module parameter in "services/help", and the name parameter in "services/problem.php".Recommendations
For Horde Application Framework versions 3.0.0 through 3.0.10, update to a version outside of this range to mitigate the risk.
For Horde Application Framework versions 3.1.0 through 3.1.1, update to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting access to the "services/go.php", "services/help", and "services/problem.php" endpoints until a patch is available.
Avoid using the
url parameter in "services/go.php", the module parameter in "services/help", and the name parameter in "services/problem.php" until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Horde Application Framework