PT-2006-5066 · Horde · Horde Imp H3

Marc Ruef · Published 2006-08-21 · Updated 2025-01-17 · CVE-2006-4255

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Horde IMP H3 versions prior to 4.1.3

Description A cross-site scripting (XSS) issue allows remote attackers to include arbitrary web script or HTML via multiple unspecified vectors related to folder names, as injected into the vfolder label form field in the IMP search screen.

Recommendations For versions prior to 4.1.3, update to version 4.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the IMP search screen until the update is applied.

Fix

Related Identifiers

CVE-2006-4255

Affected Products

Horde Imp H3

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2006-4255 · Security Note
• http://secunia.com/advisories/21533 · Vendor Advisory
• http://securityreason.com/securityalert/1423 · Note
• http://securityfocus.com/archive/1/443361/100/0/threaded · Note
• http://securitytracker.com/id?1016713 · Note
• http://lists.horde.org/archives/announce/2006/000294.html · Note
• http://vupen.com/english/advisories/2006/3316 · Note
• http://scip.ch/cgi-bin/smss/showadvf.pl?id=2457 · Note
• https://t.me/cvenotify/107764 · Telegram Post
• http://securityfocus.com/bid/19544 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28409 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4255 · Note