CVE-2004-2741 Cross-site scripting (XSS) vulnerability in the "help window" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) module, (2) top...
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the "help window" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) module, (2) topic, or (3) module parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| horde application framework | = 2.0 | No fix listed |
| horde application framework | = 2.1 | No fix listed |
| horde application framework | = 2.1.3 | No fix listed |
| horde application framework | = 2.2 | No fix listed |
| horde application framework | = 2.2.1 | No fix listed |
| horde application framework | = 2.2.3 | No fix listed |
| horde application framework | = 2.2.4 | No fix listed |
| horde application framework | = 2.2.4_rc1 | No fix listed |
| horde application framework | = 2.2.5 | No fix listed |
| horde application framework | = 2.2.6 | No fix listed |
References
- cvs.horde.org
- [horde-announce] 20041026 Horde 2.2.7 (final) mailing-list patch
- 12992 patch third-party-advisory vendor-advisory
- 1011959 vdb-entry
- 11164 vdb-entry
- 11546 vdb-entry
- horde-help-window-xss(17881) vdb-entry