4.3

CVE-2012-0791

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names.  NOTE: some of these details are obtained from third party information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Horde ≫ Dynamic Imp Version <= 5.0.17
Horde ≫ Dynamic Imp Version 1.0
Horde ≫ Dynamic Imp Version 1.0 Update alpha
Horde ≫ Dynamic Imp Version 1.0 Update rc1
Horde ≫ Dynamic Imp Version 1.0 Update rc2
Horde ≫ Dynamic Imp Version 1.0 Update rc3
Horde ≫ Dynamic Imp Version 1.1
Horde ≫ Dynamic Imp Version 1.1 Update rc1
Horde ≫ Dynamic Imp Version 1.1 Update rc2
Horde ≫ Dynamic Imp Version 1.1.1
Horde ≫ Dynamic Imp Version 1.1.2
Horde ≫ Dynamic Imp Version 1.1.3
Horde ≫ Dynamic Imp Version 1.1.4
Horde ≫ Dynamic Imp Version 1.1.5
Horde ≫ Dynamic Imp Version 1.1.6
Horde ≫ Dynamic Imp Version 5.0
Horde ≫ Dynamic Imp Version 5.0.1
Horde ≫ Dynamic Imp Version 5.0.2
Horde ≫ Dynamic Imp Version 5.0.3
Horde ≫ Dynamic Imp Version 5.0.4
Horde ≫ Dynamic Imp Version 5.0.5
Horde ≫ Dynamic Imp Version 5.0.6
Horde ≫ Dynamic Imp Version 5.0.7
Horde ≫ Dynamic Imp Version 5.0.8
Horde ≫ Dynamic Imp Version 5.0.9
Horde ≫ Dynamic Imp Version 5.0.10
Horde ≫ Dynamic Imp Version 5.0.11
Horde ≫ Dynamic Imp Version 5.0.12
Horde ≫ Dynamic Imp Version 5.0.13
Horde ≫ Dynamic Imp Version 5.0.14
Horde ≫ Dynamic Imp Version 5.0.15
Horde ≫ Dynamic Imp Version 5.0.16
Horde ≫ Imp Version 2.0
Horde ≫ Imp Version 2.2
Horde ≫ Imp Version 2.2.1
Horde ≫ Imp Version 2.2.2
Horde ≫ Imp Version 2.2.3
Horde ≫ Imp Version 2.2.4
Horde ≫ Imp Version 2.2.5
Horde ≫ Imp Version 2.2.6
Horde ≫ Imp Version 2.2.7
Horde ≫ Imp Version 2.2.8
Horde ≫ Imp Version 2.3
Horde ≫ Imp Version 3.0
Horde ≫ Imp Version 3.1
Horde ≫ Imp Version 3.1.2
Horde ≫ Imp Version 3.2
Horde ≫ Imp Version 3.2.1
Horde ≫ Imp Version 3.2.2
Horde ≫ Imp Version 3.2.3
Horde ≫ Imp Version 3.2.4
Horde ≫ Imp Version 3.2.5
Horde ≫ Imp Version 3.2.6
Horde ≫ Imp Version 3.2.7
Horde ≫ Imp Version 3.2.7 Update rc1
Horde ≫ Imp Version 4.0
Horde ≫ Imp Version 4.0.1
Horde ≫ Imp Version 4.0.2
Horde ≫ Imp Version 4.0.3
Horde ≫ Imp Version 4.0.4
Horde ≫ Imp Version 4.1.3
Horde ≫ Imp Version 4.1.5
Horde ≫ Imp Version 4.1.6
Horde ≫ Imp Version 4.2
Horde ≫ Imp Version 4.2.1
Horde ≫ Imp Version 4.2.2
Horde ≫ Imp Version 4.3
Horde ≫ Imp Version 4.3.1
Horde ≫ Imp Version 4.3.2
Horde ≫ Imp Version 4.3.3
Horde ≫ Imp Version 4.3.4
Horde ≫ Imp Version 4.3.5
Horde ≫ Imp Version 4.3.6
Horde ≫ Imp Version 4.3.7
Horde ≫ Imp Version 4.3.8
Horde ≫ Imp Version 4.3.9
Horde ≫ Imp Version 5.0
Horde ≫ Imp Version 5.0 Update alpha1
Horde ≫ Imp Version 5.0 Update beta1
Horde ≫ Imp Version 5.0 Update rc1
Horde ≫ Imp Version 5.0 Update rc2
Horde ≫ Imp Version 5.0.1
Horde ≫ Imp Version 5.0.2
Horde ≫ Imp Version 5.0.3
Horde ≫ Imp Version 5.0.4-git
Horde ≫ Groupware Webmail Edition Version <= 4.0.5
Horde ≫ Groupware Webmail Edition Version 1.0 Update rc1
Horde ≫ Groupware Webmail Edition Version 1.0 Update rc2
Horde ≫ Groupware Webmail Edition Version 1.0.1
Horde ≫ Groupware Webmail Edition Version 1.0.2
Horde ≫ Groupware Webmail Edition Version 1.0.3
Horde ≫ Groupware Webmail Edition Version 1.0.4
Horde ≫ Groupware Webmail Edition Version 1.0.5
Horde ≫ Groupware Webmail Edition Version 1.0.6
Horde ≫ Groupware Webmail Edition Version 1.0.7
Horde ≫ Groupware Webmail Edition Version 1.0.8
Horde ≫ Groupware Webmail Edition Version 1.1 Update rc1
Horde ≫ Groupware Webmail Edition Version 1.1 Update rc2
Horde ≫ Groupware Webmail Edition Version 1.1 Update rc3
Horde ≫ Groupware Webmail Edition Version 1.1 Update rc4
Horde ≫ Groupware Webmail Edition Version 1.1.1
Horde ≫ Groupware Webmail Edition Version 1.1.2
Horde ≫ Groupware Webmail Edition Version 1.1.3
Horde ≫ Groupware Webmail Edition Version 1.1.4
Horde ≫ Groupware Webmail Edition Version 1.1.5
Horde ≫ Groupware Webmail Edition Version 1.1.6
Horde ≫ Groupware Webmail Edition Version 1.2 Update rc1
Horde ≫ Groupware Webmail Edition Version 1.2.1
Horde ≫ Groupware Webmail Edition Version 1.2.2
Horde ≫ Groupware Webmail Edition Version 1.2.3
Horde ≫ Groupware Webmail Edition Version 1.2.3 Update rc1
Horde ≫ Groupware Webmail Edition Version 1.2.4
Horde ≫ Groupware Webmail Edition Version 1.2.5
Horde ≫ Groupware Webmail Edition Version 1.2.6
Horde ≫ Groupware Webmail Edition Version 1.2.7
Horde ≫ Groupware Webmail Edition Version 1.2.8
Horde ≫ Groupware Webmail Edition Version 1.2.9
Horde ≫ Groupware Webmail Edition Version 1.2.10
Horde ≫ Groupware Webmail Edition Version 4.0 Update rc1
Horde ≫ Groupware Webmail Edition Version 4.0 Update rc2
Horde ≫ Groupware Webmail Edition Version 4.0.1
Horde ≫ Groupware Webmail Edition Version 4.0.2
Horde ≫ Groupware Webmail Edition Version 4.0.3
Horde ≫ Groupware Webmail Edition Version 4.0.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.44% 0.822
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://secunia.com/advisories/47580
Vendor Advisory
http://secunia.com/advisories/47592
Vendor Advisory
http://www.debian.org/security/2012/dsa-2485
http://www.horde.org/apps/imp/docs/CHANGES
http://www.horde.org/apps/imp/docs/RELEASE_NOTES
http://www.horde.org/apps/webmail/docs/CHANGES
http://www.horde.org/apps/webmail/docs/RELEASE_NOTES
http://www.openwall.com/lists/oss-security/2012/01/22/2
http://www.securityfocus.com/bid/51586
http://www.securitytracker.com/id?1026553
http://www.securitytracker.com/id?1026554