PT-2007-3049 · Horde · Horde Groupware Webmail

Published 2007-03-26 · Updated 2025-01-17 · CVE-2007-1679

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Horde Groupware Webmail version 1.0

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in the imp/search.php and ingo/rule.php files. However, it is noted that the vendor disputes this issue, stating that the search.php problem was previously resolved and that attackers can only use rule.php to inject XSS into their own pages.

Recommendations: For Horde Groupware Webmail version 1.0, consider restricting access to the imp/search.php and ingo/rule.php files to minimize the risk of exploitation. As a temporary workaround, consider disabling the functionality provided by these files until a patch or further guidance is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-1679

Affected Products

Horde Groupware Webmail

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-1679 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33228 · Note
• http://securityreason.com/securityalert/2487 · Note
• http://securityfocus.com/bid/23136 · Note
• http://securityfocus.com/archive/1/463819/100/0/threaded · Note
• https://t.me/cvenotify/107764 · Telegram Post
• http://securityfocus.com/archive/1/463911/100/0/threaded · Note