Multiple Cross-Site Scripting Vulnerabilities in Horde Application Framework and Groupware
CVE-2009-3701

Currently unrated

Key Information:

Vendor: Horde
Status: Application Framework; Groupware
Vendor: CVE Published:; 21 December 2009

What is CVE-2009-3701?

The Horde Application Framework and its Groupware components are susceptible to multiple cross-site scripting (XSS) vulnerabilities. Attackers can exploit these weaknesses through the administration interface, particularly via the PHP_SELF variable associated with specific scripts such as phpshell.php, cmdshell.php, or sqlshell.php located in the admin directory. This exposure allows unauthorized individuals to inject arbitrary HTML or web scripts, potentially compromising user data and application integrity.

References

http://secunia.com/advisories/37823

third-party-advisoryx_refsource_SECUNIA

http://marc.info/?l=horde-announce&m=126100750018478&w=2

mailing-listx_refsource_MLIST

http://archives.neohapsis.com/archives/fulldisclosure/200...

mailing-listx_refsource_FULLDISC

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 21, 2009
Vulnerability Reserved
Oct 15, 2009

CVE-2009-3701 Data

JSON