IMP CVE-2010-4778 Cross-Site Scripting Vulnerability
BID:73818
Info
IMP CVE-2010-4778 Cross-Site Scripting Vulnerability
| Bugtraq ID: | 73818 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-4778 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 04 2011 12:00AM |
| Updated: | Apr 04 2011 12:00AM |
| Credit: | Unknown |
| Vulnerable: |
Horde Project IMP 4.3.7 Horde Project IMP 4.3.5 Horde Project IMP 4.3.4 Horde Project IMP 4.3.3 Horde Project IMP 4.3.2 Horde Project IMP 4.2.2 Horde Project IMP 4.2.1 Horde Project IMP 4.1.5 Horde Project IMP 4.0.4 Horde Project IMP 4.0.3 Horde Project IMP 4.0.2 Horde Project IMP 4.0.1 Horde Project IMP 3.2.7 Horde Project IMP 3.2.6 Horde Project IMP 3.2.5 Horde Project IMP 3.2.4 Horde Project IMP 3.2.3 Horde Project IMP 3.2.2 Horde Project IMP 3.2.1 Horde Project IMP 3.1.4 Horde Project IMP 3.1.2 Horde Project IMP 2.2.8 Horde Project IMP 2.2.7 Horde Project IMP 2.2.6 Horde Project IMP 2.2.5 Horde Project IMP 2.2.4 Horde Project IMP 2.2.3 Horde Project IMP 2.2.2 Horde Project IMP 2.2.1 Horde Project IMP 4.3.6 Horde Project IMP 4.3.1 Horde Project IMP 4.3 Horde Project IMP 4.2 Horde Project IMP 4.1.6 Horde Project IMP 4.1.3 Horde Project IMP 4.0 Horde Project IMP 3.2.7 Rc1 Horde Project IMP 3.2 Horde Project IMP 3.0 Horde Project IMP 2.3 Horde Project IMP 2.2 Horde Project IMP 2.0 Horde Project Groupware Webmail Edition 1.2.5 Horde Project Groupware Webmail Edition 1.2.4 Horde Project Groupware Webmail Edition 1.2.3 RC1 Horde Project Groupware Webmail Edition 1.2.2 Horde Project Groupware Webmail Edition 1.2.1 Horde Project Groupware Webmail Edition 1.1.6 Horde Project Groupware Webmail Edition 1.1.5 Horde Project Groupware Webmail Edition 1.1.4 Horde Project Groupware Webmail Edition 1.1.2 Horde Project Groupware Webmail Edition 1.1.1 Horde Project Groupware Webmail Edition 1.0.8 Horde Project Groupware Webmail Edition 1.0.6 Horde Project Groupware Webmail Edition 1.0.5 Horde Project Groupware Webmail Edition 1.0.4 Horde Project Groupware Webmail Edition 1.0.3 Horde Project Groupware Webmail Edition 1.2 Horde Project Groupware Webmail Edition 1.0-RC2 Horde Project Groupware Webmail Edition 1.0 Horde Project Groupware 1.2.6 Webmail Horde Project Groupware 1.2.3 Webmail Horde Project Groupware 1.2 Rc1 Webmail Horde Project Groupware 1.1.3 Webmail Horde Project Groupware 1.1 Webmail Horde Project Groupware 1.1 Rc4 Webmail Horde Project Groupware 1.1 Rc3 Webmail Horde Project Groupware 1.1 Rc2 Webmail Horde Project Groupware 1.1 Rc1 Webmail Horde Project Groupware 1.0.7 Webmail Horde Project Groupware 1.0.2 Webmail Horde Project Groupware 1.0.1 Webmail Horde Project Groupware 1.0 Rc1 Webmail |
| Not Vulnerable: | |
Discussion
IMP CVE-2010-4778 Cross-Site Scripting Vulnerability
IMP is prone to a cross-site scripting vulnerability. Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information.
IMP is prone to a cross-site scripting vulnerability. Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information.
Exploit / POC
IMP CVE-2010-4778 Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
References
IMP CVE-2010-4778 Cross-Site Scripting Vulnerability
References:
References: