CVE-2005-4190 Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonst...
LowCVSS 3.5
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| horde application framework | = 1.0.0 | No fix listed |
| horde application framework | = 1.0.2 | No fix listed |
| horde application framework | = 1.0.2_1 | No fix listed |
| horde application framework | = 1.0.3 | No fix listed |
| horde application framework | = 1.0.3_2 | No fix listed |
| horde application framework | = 1.0.3_3 | No fix listed |
| horde application framework | = 1.0.3_4 | No fix listed |
| horde application framework | = 1.0.4 | No fix listed |
| horde application framework | = 1.0.5 | No fix listed |
| horde application framework | = 1.0.6 | No fix listed |
| horde application framework | = 1.0.8 | No fix listed |
| horde application framework | = 1.0.9 | No fix listed |
| horde application framework | = 1.0.10 | No fix listed |
| horde application framework | = 1.0.11 | No fix listed |
| horde application framework | = 1.2.0 | No fix listed |
| horde application framework | = 1.2.1 | No fix listed |
| horde application framework | = 1.2.2 | No fix listed |
| horde application framework | = 1.2.3 | No fix listed |
| horde application framework | = 1.2.4 | No fix listed |
| horde application framework | = 1.2.5 | No fix listed |
| horde application framework | = 1.2.6 | No fix listed |
| horde application framework | = 1.2.7 | No fix listed |
| horde application framework | = 1.2.8 | No fix listed |
| horde application framework | = 1.3.3 | No fix listed |
| horde application framework | = 1.3.4 | No fix listed |
Show 18 more
| Product | Affected versions | Fixed in |
|---|---|---|
| horde application framework | = 2.0 | No fix listed |
| horde application framework | = 2.1 | No fix listed |
| horde application framework | = 2.2 | No fix listed |
| horde application framework | = 2.2.1 | No fix listed |
| horde application framework | = 2.2.3 | No fix listed |
| horde application framework | = 2.2.4 | No fix listed |
| horde application framework | = 2.2.5 | No fix listed |
| horde application framework | = 2.2.6 | No fix listed |
| horde application framework | = 2.2.7 | No fix listed |
| horde application framework | = 2.2.8 | No fix listed |
| horde application framework | = 2.2.9 | No fix listed |
| horde application framework | = 3.0.1 | No fix listed |
| horde application framework | = 3.0.2 | No fix listed |
| horde application framework | = 3.0.3 | No fix listed |
| horde application framework | = 3.0.4 | No fix listed |
| horde application framework | = 3.0.5 | No fix listed |
| horde application framework | = 3.0.6 | No fix listed |
| horde application framework | = 3.0.7 | No fix listed |
References
- [horde-announce] 20051211 Horde 3.0.8 (final) mailing-list patch
- 17970 patch third-party-advisory vendor-advisory
- 19619 third-party-advisory vendor-advisory
- 19897 third-party-advisory vendor-advisory
- 20960 third-party-advisory vendor-advisory
- DSA-1033 vendor-advisory
- SUSE-SR:2006:009 vendor-advisory
- SUSE-SR:2006:016 vendor-advisory
- www.sec-consult.com
- 15802 vdb-entry
- 15803 vdb-entry
- 15804 vdb-entry
- 15806 vdb-entry
- 15808 vdb-entry
- 15810 vdb-entry
- ADV-2005-2835 vdb-entry vendor-advisory