Cross-site scripting (XSS) vulnerability in Horde Turba module before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.

The version of Horde Turba installed on the remote host suffers from a cross-site scripting vulnerability in which an attacker can inject arbitrary HTML and script code into an unsuspecting user's browser, enabling him to steal cookie-based authentication credentials and perform other such attacks.

According to its version, the remote installation of Turba fails to fully sanitize user-supplied input when setting the parent frame's page title by JavaScript in 'templates/common-footer.inc'.  By leveraging this flaw, an attacker may be able to inject arbitrary HTML and script code into a user's browser to be executed in the context of the affected website, thereby resulting in the theft of session cookies and similar attacks.

According to its version, the remote installation of Horde fails to fully sanitize user-supplied input when setting the parent frame's page title by JavaScript in 'templates/common-footer.inc'.  By leveraging this flaw, an attacker may be able to inject arbitrary HTML and script code into a user's browser to be executed in the context of the affected website, thereby resulting in the theft of session cookies and similar attacks.

ID	Name	Product	Family	Severity
2857	Horde Turba < 1.2.5 Parent Frame Page Title XSS	Nessus Network Monitor	CGI	low
18138	Horde Turba common-footer.inc Parent Frame Page Title XSS	Nessus	CGI abuses : XSS	medium
18132	Horde Turba Contact Manager common-footer.inc Parent Frame Page Title XSS	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2005-1315

medium

Tenable Plugins

low

medium

medium