BID:11546

Horde Application Framework Help Window Unspecified Cross-Site Scripting Vulnerability

Info

Horde Application Framework Help Window Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	11546
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 27 2004 12:00AM
Updated:	Oct 27 2004 12:00AM
Credit:	The vendor reported this vulnerability.
Vulnerable:	Horde Project Horde 2.2.6 Horde Project Horde 2.2.5 Horde Project Horde 2.2.4 -RC1 Horde Project Horde 2.2.4 Horde Project Horde 2.2.3 Horde Project Horde 2.2.1 Horde Project Horde 2.2 Horde Project Horde 2.1.3 Horde Project Horde 2.1 Horde Project Horde 2.0

Not Vulnerable:	Horde Project Horde 2.2.7

Discussion

Horde Application Framework Help Window Unspecified Cross-Site Scripting Vulnerability

Horde Application Framework is reported prone to an unspecified cross-site scripting vulnerability. This issue arises due to insufficient sanitization of user-supplied data. A remote attacker may exploit this vulnerability to execute arbitrary HTML and script code in the browser of a vulnerable user.

This issue can facilitate attacks such as the theft of cookie-based authentication credentials. Other attacks are possible as well.

Horde Application Framework versions 2.2.6 and prior are reported prone to this vulnerability.

Exploit / POC

Horde Application Framework Help Window Unspecified Cross-Site Scripting Vulnerability

No exploit is required.

Solution / Fix

Horde Application Framework Help Window Unspecified Cross-Site Scripting Vulnerability

Solution:
The vendor has released Horde 2.2.7 to address this issue.

Horde Project Horde 2.0