Detections
Analytics

Horde Passwd Module < 3.1.1 XSS

medium Nessus Network Monitor Plugin ID 5092

Synopsis

The remote web server contains a PHP application that is vulnerable to cross-site scripting attacks.

Description

The installation of Horde is using the Passwd module which provides support for changing passwords. The installed version of this module is earlier than 3.1.1. Such versions are reportedly affected by a cross-site scripting vulnerability that affects the 'backend' parameter of the 'main.php' script. An attacker can exploit this to execute arbitrary script code in the browser of an authenticated user.

Solution

Upgrade to Passwd H3 3.1.1 or later.

See Also

http://lists.horde.org/archives/announce/2009/000507.html

Plugin Details

Severity: Medium

ID: 5092

Family: CGI

Published: 8/18/2004

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Low

Score: 3.8

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS v3

Risk Factor: Medium

Base Score: 4.8

Temporal Score: 4.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:horde:passwd

Reference Information

CVE: CVE-2009-2360

BID: 35573