Improper Image Proxy Restriction in Horde Application Framework
CVE-2006-3549

Currently unrated

Key Information:

Vendor: Horde
Status: Horde Application Framework
Vendor: CVE Published:; 13 July 2006

What is CVE-2006-3549?

The Horde Application Framework versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 are susceptible to a vulnerability that fails to properly restrict its image proxy capability. This flaw allows remote attackers to exploit the server for Web tunneling by passing manipulated URLs through the 'url' parameter. Attackers can potentially access certain undesired content or bypass restrictions, utilizing the server as a proxy for HTTP, HTTPS, and FTP URLs.

References

http://lists.horde.org/archives/announce/2006/000287.html

x_refsource_CONFIRM

http://www.securityfocus.com/bid/18845

vdb-entryx_refsource_BID

http://www.vupen.com/english/advisories/2006/2694

vdb-entryx_refsource_VUPEN

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 13, 2006
Vulnerability Reserved
Jul 12, 2006

CVE-2006-3549 Data

JSON