Horde Products Search.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	19544
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 16 2006 12:00AM
Updated:	Aug 16 2006 11:00PM
Credit:	Marc Ruef is credited with the discovery of this vulnerability.
Vulnerable:	Horde Project IMP 4.0.4 Horde Project IMP 4.0.3 Horde Project IMP 4.0.2 Horde Project IMP 4.0.1 Horde Project IMP 4.0 Horde Project IMP 3.2.5 Horde Project IMP 3.2.4 Horde Project IMP 3.2.3 Horde Project IMP 3.2.2 Horde Project IMP 3.2.1 Horde Project IMP 3.2 Horde Project IMP 3.1.2 Horde Project IMP 3.1 Horde Project IMP 3.0 Horde Project IMP 2.3 Horde Project IMP 2.2.8 + Horde Project Horde 1.2.8 Horde Project IMP 2.2.7 - Caldera OpenLinux Server 3.1.1 - Caldera OpenLinux Server 3.1 + Horde Project Horde 1.2.7 Horde Project IMP 2.2.6 - Debian Linux 2.2 + Horde Project Horde 1.2.6 Horde Project IMP 2.2.5 + Caldera OpenLinux Server 3.1 + Horde Project Horde 1.2.5 Horde Project IMP 2.2.4 + Caldera OpenLinux Server 3.1 + Horde Project Horde 1.2.4 Horde Project IMP 2.2.3 + Horde Project Horde 1.2.3 Horde Project IMP 2.2.2 + Horde Project Horde 1.2.2 Horde Project IMP 2.2.1 + Horde Project Horde 1.2.1 Horde Project IMP 2.2 + Horde Project Horde 1.2 Horde Project IMP 2.0 - PHP PHP 4.0.1 pl2 - PHP PHP 4.0.1 - PHP PHP 4.0 0 - PHP PHP 3.0.16 Horde Project Horde 3.1.1 Horde Project Horde 3.0.9 Horde Project Horde 3.0.8 Horde Project Horde 3.0.7 Horde Project Horde 3.0.6 Horde Project Horde 3.0.4 -RC 2 Horde Project Horde 3.0.4 -RC 1 Horde Project Horde 3.0.4 Horde Project Horde 3.0.3 Horde Project Horde 3.0.2 Horde Project Horde 3.0.1 Horde Project Horde 3.0 Horde Project Horde 3.1
Not Vulnerable:	Horde Project Horde IMP 4.1.3 Horde Project Horde 3.1.2

Horde Products Search.PHP Cross-Site Scripting Vulnerability

Various Horde products are prone to a cross-site scripting vulnerability because the applications fail to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Horde Products Search.PHP Cross-Site Scripting Vulnerability

Attackers can exploit this issue via a web client.

Horde Products Search.PHP Cross-Site Scripting Vulnerability

Solution:
The vendor has released software updates to address these issues. Please see the references for details.

mailto:[email protected]

Horde Products Search.PHP Cross-Site Scripting Vulnerability

References:

• Pandora Homepage (Pandora FMS Team)