4.3

CVE-2010-3693

Exploit
Cross-site scripting (XSS) vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via vectors related to displaying mailbox names.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Horde ≫ Groupware Version <= 1.2.6
Horde ≫ Groupware Version 1.0
Horde ≫ Groupware Version 1.0 Update rc1
Horde ≫ Groupware Version 1.0 Update rc2
Horde ≫ Groupware Version 1.0.1
Horde ≫ Groupware Version 1.0.2
Horde ≫ Groupware Version 1.0.3
Horde ≫ Groupware Version 1.0.4
Horde ≫ Groupware Version 1.0.5
Horde ≫ Groupware Version 1.0.6
Horde ≫ Groupware Version 1.0.7
Horde ≫ Groupware Version 1.0.8
Horde ≫ Groupware Version 1.1
Horde ≫ Groupware Version 1.1 Update rc1
Horde ≫ Groupware Version 1.1 Update rc2
Horde ≫ Groupware Version 1.1 Update rc3
Horde ≫ Groupware Version 1.1 Update rc4
Horde ≫ Groupware Version 1.1.1
Horde ≫ Groupware Version 1.1.2
Horde ≫ Groupware Version 1.1.3
Horde ≫ Groupware Version 1.1.4
Horde ≫ Groupware Version 1.1.5
Horde ≫ Groupware Version 1.1.6
Horde ≫ Groupware Version 1.2
Horde ≫ Groupware Version 1.2 Update rc1
Horde ≫ Groupware Version 1.2.1
Horde ≫ Groupware Version 1.2.2
Horde ≫ Groupware Version 1.2.3
Horde ≫ Groupware Version 1.2.3 Update rc1
Horde ≫ Groupware Version 1.2.4
Horde ≫ Groupware Version 1.2.5
Horde ≫ Dynamic Imp Version <= 1.1.4
Horde ≫ Dynamic Imp Version 1.0
Horde ≫ Dynamic Imp Version 1.0 Update alpha
Horde ≫ Dynamic Imp Version 1.0 Update rc1
Horde ≫ Dynamic Imp Version 1.0 Update rc2
Horde ≫ Dynamic Imp Version 1.0 Update rc3
Horde ≫ Dynamic Imp Version 1.1
Horde ≫ Dynamic Imp Version 1.1 Update rc1
Horde ≫ Dynamic Imp Version 1.1 Update rc2
Horde ≫ Dynamic Imp Version 1.1.1
Horde ≫ Dynamic Imp Version 1.1.2
Horde ≫ Dynamic Imp Version 1.1.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.59% 0.833
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde&r1=1.35.2.11&r2=1.35.2.13&ty=h
Patch
http://lists.horde.org/archives/announce/2010/000568.html
Patch
http://openwall.com/lists/oss-security/2010/09/30/7
Patch
Exploit
http://openwall.com/lists/oss-security/2010/09/30/8
Patch
http://openwall.com/lists/oss-security/2010/10/01/6
Patch
http://bugs.horde.org/ticket/9240
Patch
http://cvs.horde.org/diff.php/dimp/docs/CHANGES?rt=horde&r1=1.69.2.82&r2=1.69.2.87&ty=h
http://git.horde.org/diff.php/imp/lib/Views/ListMessages.php?rt=horde-git&r1=b496687e2e71f3ebaecdff5ee49561fbfc1c74cb&r2=48913cf3af81875d6e5c6f32e030c5913f22f25d
Patch
http://lists.horde.org/archives/announce/2010/000561.html
Patch
http://secunia.com/advisories/41639
Vendor Advisory
http://www.osvdb.org/68267
http://www.vupen.com/english/advisories/2010/2522
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/62080