PT-2008-5173 · Popoon+1 · Popoon+1

Alexios Fakos · Published 2008-09-12 · Updated 2018-10-11 · CVE-2008-3824

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Horde versions 3.1.x through 3.1.8 Horde versions 3.2.x through 3.2.1 Popoon version r22196 and earlier

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by using / (slash) characters as replacements for spaces in an HTML e-mail message. This occurs due to insufficient input validation in the Text Filter/Filter/xss.php file in Horde and the externalinput.php file in Popoon.

Recommendations For Horde versions 3.1.x through 3.1.8, update to version 3.1.9 or later. For Horde versions 3.2.x through 3.2.1, update to version 3.2.2 or later. For Popoon version r22196 and earlier, update to a version later than r22196.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-3824

DSA-1642-1

DTSA-165-1

Affected Products

Horde

Popoon

References · 18

• 🔥 https://exploit-db.com/exploits/32353 · Exploit
• 🔥 http://securityfocus.com/bid/31107 · Exploit
• http://marc.info/?l=horde-announce&m=122103888111491&w=2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-3824 · Security Note
• http://secunia.com/advisories/31842 · Vendor Advisory
• http://ocert.org/patches/2008-012/Text_Filter.patch · Patch
• http://ocert.org/advisories/ocert-2008-012.html · Patch
• http://ocert.org/patches/2008-012/Text_Filter.31.patch · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3824 · Note
• http://securityreason.com/securityalert/4245 · Note
• http://phpmyfaq.de/advisory_2008-09-11.php · Note
• http://openwall.com/lists/oss-security/2008/09/10/1 · Note
• http://vupen.com/english/advisories/2008/2548 · Note
• http://securityfocus.com/archive/1/496182/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45031 · Note