Dynamic Imp CVE-2010-3693 Cross-Site Scripting Vulnerability
BID:73771
Info
Dynamic Imp CVE-2010-3693 Cross-Site Scripting Vulnerability
| Bugtraq ID: | 73771 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-3693 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 04 2011 12:00AM |
| Updated: | Apr 04 2011 12:00AM |
| Credit: | Unknown |
| Vulnerable: |
Horde Project Groupware Webmail Edition 1.2.5 Horde Project Groupware Webmail Edition 1.2.4 Horde Project Groupware Webmail Edition 1.2.3 RC1 Horde Project Groupware Webmail Edition 1.2.2 Horde Project Groupware Webmail Edition 1.2.1 Horde Project Groupware Webmail Edition 1.1.6 Horde Project Groupware Webmail Edition 1.1.5 Horde Project Groupware Webmail Edition 1.1.4 Horde Project Groupware Webmail Edition 1.1.2 Horde Project Groupware Webmail Edition 1.1.1 Horde Project Groupware Webmail Edition 1.0.8 Horde Project Groupware Webmail Edition 1.0.6 Horde Project Groupware Webmail Edition 1.0.5 Horde Project Groupware Webmail Edition 1.0.4 Horde Project Groupware Webmail Edition 1.0.3 Horde Project Groupware Webmail Edition 1.2 Horde Project Groupware Webmail Edition 1.0-RC2 Horde Project Groupware Webmail Edition 1.0 Horde Project Groupware 1.2.6 Webmail Horde Project Groupware 1.2.3 Webmail Horde Project Groupware 1.2 Rc1 Webmail Horde Project Groupware 1.1.3 Webmail Horde Project Groupware 1.1 Webmail Horde Project Groupware 1.1 Rc4 Webmail Horde Project Groupware 1.1 Rc3 Webmail Horde Project Groupware 1.1 Rc2 Webmail Horde Project Groupware 1.1 Rc1 Webmail Horde Project Groupware 1.0.7 Webmail Horde Project Groupware 1.0.2 Webmail Horde Project Groupware 1.0.1 Webmail Horde Project Groupware 1.0 Rc1 Webmail Horde Project Dynamic Imp 1.1.4 Horde Project Dynamic Imp 1.1.3 Horde Project Dynamic Imp 1.1.2 Horde Project Dynamic Imp 1.1.1 Horde Project Dynamic Imp 1.1 RC2 Horde Project Dynamic Imp 1.1 RC1 Horde Project Dynamic Imp 1.1 Horde Project Dynamic Imp 1.0 RC3 Horde Project Dynamic Imp 1.0 Rc2 Horde Project Dynamic Imp 1.0 Rc1 Horde Project Dynamic Imp 1.0 Alpha Horde Project Dynamic Imp 1.0 |
| Not Vulnerable: | |
Discussion
Dynamic Imp CVE-2010-3693 Cross-Site Scripting Vulnerability
Dynamic Imp is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via vectors related to displaying mailbox names.
Dynamic Imp is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via vectors related to displaying mailbox names.
Exploit / POC
Dynamic Imp CVE-2010-3693 Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
References
Dynamic Imp CVE-2010-3693 Cross-Site Scripting Vulnerability
References:
References:
- [announce] Horde Groupware Webmail Edition 1.2.7 (final) (MLIST)
- DIMP H3 (1.1.5) (Horde Project)
- Horde :: Log in (CONFIRM)
- Horde :: Log in (CONFIRM)
- Horde :: Log in (CONFIRM)
- IBM X-Force Exchange Beta (XF)
- oss-security - Re: CVE request: Horde Gollem <1.1.2 XSS in view.php (MLIST)
- oss-security - Re: CVE request: Horde Gollem <1.1.2 XSS in view.php (MLIST)
- oss-security - Re: CVE request: Horde Gollem <1.1.2 XSS in view.php (MLIST)
- Tickets :: [#9240] XSS: Mailbox name not encoded properly (CONFIRM)