CVE-2007-1515 Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in threa...
MediumCVSS 4.3
EPSS 2.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via (1) the email Subject header in thread.php, (2) the edit_query parameter in search.php, or other unspecified parameters in search.php. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| horde imp | <= 4.1.3 | No fix listed |
References
- 20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues exploit mailing-list vendor-advisory
- [announce] 20070314 IMP H3 (4.1.4) (final) mailing-list patch vendor-advisory
- 24541 third-party-advisory
- 20070315 Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues mailing-list
- 22975 vdb-entry
- 1017774 vdb-entry
- ADV-2007-0964 vdb-entry