CVE-2008-3824 Cross-site scripting (XSS) vulnerability in (1) Text_Filter/Filter/xss.php in Horde 3.1.x before 3.1.9 and 3.2.x before 3.2.2 and (2) externalinput.php in Popoon r22196 and earlier allows remote attac...
MediumCVSS 4.3
EPSS 5.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in (1) Text_Filter/Filter/xss.php in Horde 3.1.x before 3.1.9 and 3.2.x before 3.2.2 and (2) externalinput.php in Popoon r22196 and earlier allows remote attackers to inject arbitrary web script or HTML by using / (slash) characters as replacements for spaces in an HTML e-mail message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| horde | = 3.1.1 | No fix listed |
| horde | = 3.1.2 | No fix listed |
| horde | = 3.1.3 | No fix listed |
| horde | = 3.1.4 | No fix listed |
| horde | = 3.1.5 | No fix listed |
| horde | = 3.1.6 | No fix listed |
| horde | = 3.1.7 | No fix listed |
| horde | = 3.1.8 | No fix listed |
| horde | = 3.2 | No fix listed |
| horde | = 3.2.1 | No fix listed |
| popoon | <= r22196 | No fix listed |
References
- blog.liip.ch
- [horde-announce] 20080910 Horde 3.1.9 (final) mailing-list patch
- [horde-announce] 20080910 [SECURITY] Horde 3.2.2 (final) mailing-list
- ocert.org patch
- ocert.org patch
- 47996 vdb-entry
- 31842 third-party-advisory vendor-advisory
- 4245 third-party-advisory
- www.ocert.org patch
- [oss-security] 20080910 [oCERT-2008-012] Horde, Popoon frameworks common input sanitization errors (XSS) mailing-list
- www.phpmyfaq.de
- 20080910 [oCERT-2008-012] Horde, Popoon frameworks common input sanitization errors (XSS) mailing-list
- 31107 exploit vdb-entry
- ADV-2008-2548 vdb-entry
- horde-htmlmessages-xss(45031) vdb-entry