Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2009-3237

Опубликовано: 17 сент. 2009
Источник: nvd
CVSS2: 4.3
EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebar_width parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mime_drivers.php).

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:horde:horde_application_framework:3.2:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_application_framework:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_application_framework:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_application_framework:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_application_framework:3.2.4:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_application_framework:3.3:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_application_framework:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_application_framework:3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_application_framework:3.3.3:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_application_framework:3.3.4:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_groupware:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_groupware:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_groupware:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_groupware:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_groupware:1.1.5:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_groupware:1.2:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_groupware:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_groupware:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:horde:horde_groupware:1.2.3:*:*:*:*:*:*:*
Конфигурация 2

Одно из

cpe:2.3:a:horde:groupware:1.1:*:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.1:rc1:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.1:rc2:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.1:rc3:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.1:rc4:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.1.6:*:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.2:*:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.2:rc1:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:horde:groupware:1.2.3:rc1:*:*:*:*:*:*

EPSS

Процентиль: 73%
0.0076
Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

ubuntu логотип

CVE-2009-3237

ubuntu
больше 16 лет назад

Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebar_width parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mime_drivers.php).

redhat логотип

CVE-2009-3237

redhat
больше 16 лет назад

Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebar_width parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mime_drivers.php).

debian логотип

CVE-2009-3237

debian
больше 16 лет назад

Multiple cross-site scripting (XSS) vulnerabilities in Horde Applicati ...

github логотип

GHSA-9gvv-96c5-f9vx

github
больше 3 лет назад

Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebar_width parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mime_drivers.php).

EPSS

Процентиль: 73%
0.0076
Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79