4.3
CVE-2012-0909
- EPSS 1.88%
- Veröffentlicht 24.01.2012 18:55:01
- Zuletzt bearbeitet 16.06.2026 23:38:29
- Erkennungen
LoginCross-site scripting (XSS) vulnerability in Horde_Form in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to email verification. NOTE: Some of these details are obtained from third party information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Horde ≫ Groupware Webmail Edition Version <= 4.0.5
Horde ≫ Groupware Webmail Edition Version 1.0
Horde ≫ Groupware Webmail Edition Version 1.0 Update rc1
Horde ≫ Groupware Webmail Edition Version 1.0 Update rc2
Horde ≫ Groupware Webmail Edition Version 1.0.1
Horde ≫ Groupware Webmail Edition Version 1.0.2
Horde ≫ Groupware Webmail Edition Version 1.0.3
Horde ≫ Groupware Webmail Edition Version 1.0.4
Horde ≫ Groupware Webmail Edition Version 1.0.5
Horde ≫ Groupware Webmail Edition Version 1.0.6
Horde ≫ Groupware Webmail Edition Version 1.0.7
Horde ≫ Groupware Webmail Edition Version 1.0.8
Horde ≫ Groupware Webmail Edition Version 1.1
Horde ≫ Groupware Webmail Edition Version 1.1 Update rc1
Horde ≫ Groupware Webmail Edition Version 1.1 Update rc2
Horde ≫ Groupware Webmail Edition Version 1.1 Update rc3
Horde ≫ Groupware Webmail Edition Version 1.1 Update rc4
Horde ≫ Groupware Webmail Edition Version 1.1.1
Horde ≫ Groupware Webmail Edition Version 1.1.2
Horde ≫ Groupware Webmail Edition Version 1.1.3
Horde ≫ Groupware Webmail Edition Version 1.1.4
Horde ≫ Groupware Webmail Edition Version 1.1.5
Horde ≫ Groupware Webmail Edition Version 1.1.6
Horde ≫ Groupware Webmail Edition Version 1.2
Horde ≫ Groupware Webmail Edition Version 1.2 Update rc1
Horde ≫ Groupware Webmail Edition Version 1.2.1
Horde ≫ Groupware Webmail Edition Version 1.2.2
Horde ≫ Groupware Webmail Edition Version 1.2.3
Horde ≫ Groupware Webmail Edition Version 1.2.3 Update rc1
Horde ≫ Groupware Webmail Edition Version 1.2.4
Horde ≫ Groupware Webmail Edition Version 1.2.5
Horde ≫ Groupware Webmail Edition Version 1.2.6
Horde ≫ Groupware Webmail Edition Version 1.2.7
Horde ≫ Groupware Webmail Edition Version 1.2.8
Horde ≫ Groupware Webmail Edition Version 1.2.9
Horde ≫ Groupware Webmail Edition Version 1.2.10
Horde ≫ Groupware Webmail Edition Version 4.0
Horde ≫ Groupware Webmail Edition Version 4.0 Update rc1
Horde ≫ Groupware Webmail Edition Version 4.0 Update rc2
Horde ≫ Groupware Webmail Edition Version 4.0.1
Horde ≫ Groupware Webmail Edition Version 4.0.2
Horde ≫ Groupware Webmail Edition Version 4.0.3
Horde ≫ Groupware Webmail Edition Version 4.0.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.88% | 0.768 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
http://secunia.com/advisories/47592
http://www.horde.org/apps/webmail/docs/CHANGES
http://www.horde.org/apps/webmail/docs/RELEASE_NOTES
http://www.openwall.com/lists/oss-security/2012/01/22/2
http://www.securityfocus.com/bid/51586