CVE-2010-3693 Cross-site scripting (XSS) vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via....
MediumCVSS 4.3
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via vectors related to displaying mailbox names.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| horde groupware | <= 1.2.6 | No fix listed |
| horde groupware | = 1.0 | No fix listed |
| horde groupware | = 1.0-rc1 | No fix listed |
| horde groupware | = 1.0-rc2 | No fix listed |
| horde groupware | = 1.0.1 | No fix listed |
| horde groupware | = 1.0.2 | No fix listed |
| horde groupware | = 1.0.3 | No fix listed |
| horde groupware | = 1.0.4 | No fix listed |
| horde groupware | = 1.0.5 | No fix listed |
| horde groupware | = 1.0.6 | No fix listed |
| horde groupware | = 1.0.7 | No fix listed |
| horde groupware | = 1.0.8 | No fix listed |
| horde groupware | = 1.1 | No fix listed |
| horde groupware | = 1.1-rc1 | No fix listed |
| horde groupware | = 1.1-rc2 | No fix listed |
| horde groupware | = 1.1-rc3 | No fix listed |
| horde groupware | = 1.1-rc4 | No fix listed |
| horde groupware | = 1.1.1 | No fix listed |
| horde groupware | = 1.1.2 | No fix listed |
| horde groupware | = 1.1.3 | No fix listed |
| horde groupware | = 1.1.4 | No fix listed |
| horde groupware | = 1.1.5 | No fix listed |
| horde groupware | = 1.1.6 | No fix listed |
| horde groupware | = 1.2 | No fix listed |
| horde groupware | = 1.2-rc1 | No fix listed |
Show 18 more
| Product | Affected versions | Fixed in |
|---|---|---|
| horde groupware | = 1.2.1 | No fix listed |
| horde groupware | = 1.2.2 | No fix listed |
| horde groupware | = 1.2.3 | No fix listed |
| horde groupware | = 1.2.3-rc1 | No fix listed |
| horde groupware | = 1.2.4 | No fix listed |
| horde groupware | = 1.2.5 | No fix listed |
| horde dynamic imp | <= 1.1.4 | No fix listed |
| horde dynamic imp | = 1.0 | No fix listed |
| horde dynamic imp | = 1.0-alpha | No fix listed |
| horde dynamic imp | = 1.0-rc1 | No fix listed |
| horde dynamic imp | = 1.0-rc2 | No fix listed |
| horde dynamic imp | = 1.0-rc3 | No fix listed |
| horde dynamic imp | = 1.1 | No fix listed |
| horde dynamic imp | = 1.1-rc1 | No fix listed |
| horde dynamic imp | = 1.1-rc2 | No fix listed |
| horde dynamic imp | = 1.1.1 | No fix listed |
| horde dynamic imp | = 1.1.2 | No fix listed |
| horde dynamic imp | = 1.1.3 | No fix listed |
References
- bugs.horde.org patch
- cvs.horde.org
- git.horde.org patch
- git.horde.org patch
- [announce] 20100928 DIMP H3 (1.1.5) (final) mailing-list patch
- [announce] 20100928 Horde Groupware Webmail Edition 1.2.7 (final) mailing-list patch
- [oss-security] 20100930 Re: CVE request: Horde Gollem <1.1.2 XSS in view.php exploit mailing-list patch
- [oss-security] 20100930 Re: CVE request: Horde Gollem <1.1.2 XSS in view.php mailing-list patch
- [oss-security] 20101001 Re: CVE request: Horde Gollem <1.1.2 XSS in view.php mailing-list patch
- 41639 third-party-advisory vendor-advisory
- 68267 vdb-entry
- ADV-2010-2522 vdb-entry vendor-advisory
- dynamicimp-mailbox-xss(62080) vdb-entry