CVE-2009-3701

medium

Description

Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to the PHP_SELF variable.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/54817

http://www.vupen.com/english/advisories/2009/3572

http://www.vupen.com/english/advisories/2009/3549

http://www.securityfocus.com/archive/1/508531/100/0/threaded

http://securitytracker.com/id?1023365

http://secunia.com/advisories/37823

http://secunia.com/advisories/37709

http://marc.info/?l=horde-announce&m=126101076422179&w=2

http://marc.info/?l=horde-announce&m=126100750018478&w=2

http://lists.horde.org/archives/announce/2009/000529.html

http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.559&r2=1.515.2.589&ty=h

Details

Source: Mitre, NVD

Published: 2009-12-21

Updated: 2019-06-18

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: Medium