Horde GroupWare Web Mail Edition Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	63532
Class:	Input Validation Error
CVE:	CVE-2013-6364
Remote:	Yes
Local:	No
Published:	Oct 28 2013 12:00AM
Updated:	Mar 19 2015 09:39AM
Credit:	Marcela Benetrix
Vulnerable:
Not Vulnerable:

Horde GroupWare Web Mail Edition Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

Horde GroupWare Web Mail Edition is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability.

An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions in the context of the affected application. Other attacks are also possible.

Horde GroupWare Web Mail Edition 5.1.2 is vulnerable; other versions may also be affected.

Horde GroupWare Web Mail Edition Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.

The following example data is available:

• /data/vulnerabilities/exploits/63532.html.txt

Horde GroupWare Web Mail Edition Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Horde GroupWare Web Mail Edition Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

References: