Detections
Analytics
Horde IMP IMP_MIME_Viewer_html Class XSS
medium Nessus Plugin ID 11815
Language:
Synopsis
The remote web server is affected by a cross-site scripting vulnerability.Description
The remote server is running at least one instance of IMP whose version number is between 3.0 and 3.2.1 inclusive. Such versions are vulnerable to several cross-scripting attacks whereby an attacker can cause a victim to unknowingly run arbitrary JavaScript code simply by reading an HTML message from the attacker.Note : Nessus has determined the vulnerability exists on the target simply by looking at the version number of IMP installed there. If the installation has already been patched, consider this a false positive.
Solution
Upgrade to IMP version 3.2.2 or later or apply patches found in the announcements to imp/lib/MIME/Viewer/html.php.See Also
https://marc.info/?l=imp&m=105940167329471&w=2
Plugin Details
Severity: Medium
ID: 11815
File Name: imp_mime_viewer_html_xss.nasl
Version: 1.28
Type: remote
Family: CGI abuses : XSS
Published: 8/8/2003
Updated: 6/4/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Vulnerability Information
CPE: cpe:/a:horde:imp
Excluded KB Items: Settings/disable_cgi_scanning
Vulnerability Publication Date: 7/28/2003