BID:15409

Horde Unspecified Error Message Cross-Site Scripting Vulnerability

Info

Horde Unspecified Error Message Cross-Site Scripting Vulnerability

Bugtraq ID:	15409
Class:	Input Validation Error
CVE:	CVE-2005-3570
Remote:	Yes
Local:	No
Published:	Nov 14 2005 12:00AM
Updated:	Apr 13 2006 05:17PM
Credit:	This issue was reported by the vendor.
Vulnerable:	Horde Project Horde 2.2.8 Horde Project Horde 2.2.7 Horde Project Horde 2.2.6 Horde Project Horde 2.2.5 Horde Project Horde 2.2.4 -RC1 Horde Project Horde 2.2.4 Horde Project Horde 2.2.3 Horde Project Horde 2.2.1 Horde Project Horde 2.2 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1

Not Vulnerable:	Horde Project Horde 2.2.9

Discussion

Horde Unspecified Error Message Cross-Site Scripting Vulnerability

Horde is prone to an unspecified cross-site scripting vulnerability. This issue is related to how Horde renders error messages.

Successful exploitation could let an attacker inject hostile HTML and script code into the browser session of another user in the context of the site hosting Horde. This could allow the attacker to steal cookie-based authentication credentials or to launch other attacks.

Exploit / POC

Horde Unspecified Error Message Cross-Site Scripting Vulnerability

An exploit is not required.

Solution / Fix

Horde Unspecified Error Message Cross-Site Scripting Vulnerability

Solution:

Horde 2.2.9 has been released to address this vulnerability.

Please see the referenced advisories for more information.

Horde Project Horde 2.2