Multiple Horde Products Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	60244
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 31 2013 12:00AM
Updated:	May 31 2013 12:00AM
Credit:	Joao Machado
Vulnerable:
Not Vulnerable:

Multiple Horde Products Unspecified Cross Site Scripting Vulnerability

Multiple Horde products are prone to an unspecified a cross-site scripting vulnerability.

An attacker could leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The following products are vulnerable:

Horde Application Framework versions prior to 5.0.5
Horde Groupware versions prior to 5.0.5
Horde Groupware Webmail Edition versions prior to 5.0.5
Ingo prior versions to 3.0.4
Turba versionsprior to 4.0.4
IMP versions prior to 6.0.5

Multiple Horde Products Unspecified Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Multiple Horde Products Unspecified Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Horde Products Unspecified Cross Site Scripting Vulnerability

References:

• Horde Homepage (Horde Project)