Horde Project IMP SVG Attachment HTML Injection Vulnerability

Bugtraq ID:	54195
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 26 2012 12:00AM
Updated:	Jun 26 2012 12:00AM
Credit:	Mike Cardwell
Vulnerable:	Horde Project IMP 5.0.18 Horde Project IMP 5.0.17 Horde Project IMP 5.0.16 Horde Project IMP 5.0.21 Horde Project IMP 5.0.2 Horde Project IMP 5.0.1 Horde Project IMP 5.0 Rc2 Horde Project IMP 5.0 Rc1 Horde Project IMP 5.0 Beta1 Horde Project IMP 5.0 Alpha1 Horde Project IMP 5.0
Not Vulnerable:

Horde Project IMP SVG Attachment HTML Injection Vulnerability

Horde Project IMP is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Versions prior to IMP 5.0.22 are vulnerable.

Horde Project IMP SVG Attachment HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Horde Project IMP SVG Attachment HTML Injection Vulnerability

Solution:
Updates are available. Please see the references for more information.

Horde Project IMP SVG Attachment HTML Injection Vulnerability

References:

• IMP Homepage (Horde Project)