PT-2007-2867 · Horde · Horde Framework

Published 2007-03-16 · Updated 2018-10-16 · CVE-2007-1473

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Horde Framework versions prior to 3.1.4 RC1

Description The issue is related to a cross-site scripting (XSS) vulnerability. It occurs when the login page contains a language selection box, allowing remote attackers to inject arbitrary web script or HTML via the new lang parameter to the "login.php" endpoint.

Recommendations For versions prior to 3.1.4 RC1, update to version 3.1.4 RC1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "login.php" endpoint or disabling the language selection box until a patch is applied. Avoid using the new lang parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-1473

DSA-1406-1

Affected Products

Horde Framework

References · 16

• 🔥 https://exploit-db.com/exploits/29745 · Exploit
• http://novell.com/linux/security/advisories/2007_007_suse.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1473 · Security Note
• http://lists.horde.org/archives/announce/2007/000315.html · Vendor Advisory
• http://debian.org/security/2007/dsa-1406 · Vendor Advisory
• http://secunia.com/advisories/27565 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33013 · Note
• http://vupen.com/english/advisories/2007/0965 · Note
• http://securityfocus.com/bid/22984 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1473 · Note
• http://secunia.com/advisories/24528 · Note
• http://osvdb.org/33084 · Note
• http://securitytracker.com/id?1017775 · Note
• http://securityfocus.com/archive/1/462915/100/0/threaded · Note
• http://securityreason.com/securityalert/2427 · Note