Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a language selection box, allows remote attackers to inject arbitrary web script or HTML via the new_lang parameter to login.php.

This update fixes a cross-site scripting bug (XSS) in horde.
(CVE-2007-1473)

Several remote vulnerabilities have been discovered in the Horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-3548     Moritz Naumann discovered that Horde allows remote     attackers to inject arbitrary web script or HTML in the     context of a logged in user (cross site scripting).

      This vulnerability applies to oldstable (sarge) only.

  - CVE-2006-3549     Moritz Naumann discovered that Horde does not properly     restrict its image proxy, allowing remote attackers to     use the server as a proxy.

      This vulnerability applies to oldstable (sarge) only.

  - CVE-2006-4256     Marc Ruef discovered that Horde allows remote attackers     to include web pages from other sites, which could be     useful for phishing attacks.

      This vulnerability applies to oldstable (sarge) only.

  - CVE-2007-1473     Moritz Naumann discovered that Horde allows remote     attackers to inject arbitrary web script or HTML in the     context of a logged in user (cross site scripting).

      This vulnerability applies to both stable (etch) and oldstable       (sarge).

  - CVE-2007-1474     iDefense discovered that the cleanup cron script in     Horde allows local users to delete arbitrary files.

      This vulnerability applies to oldstable (sarge) only.

This udpate fixes a cross site scripting bug (XSS) in horde (CVE-2007-1473).

The version of Horde installed on the remote host fails to sanitize input to the 'new_lang' parameter before using it in the 'framework/NLS/NLS.php' script to generate dynamic content.  An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.

The remote web server contains a PHP application that is vulnerable to a cross-site scripting attack.

 The version of Horde installed on the remote host fails to sanitize input to the 'new_lang' parameter before using it in the 'framework/NLS/NLS.php' script to generate dynamic content.  An unauthenticated remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.

ID	Name	Product	Family	Severity
41123	SuSE9 Security Update : horde (YOU Patch Number 11488)	Nessus	SuSE Local Security Checks	medium
28151	Debian DSA-1406-1 : horde3 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
27266	openSUSE 10 Security Update : horde (horde-3089)	Nessus	SuSE Local Security Checks	medium
24817	Horde NLS.php Language Selection new_lang Parameter XSS	Nessus	CGI abuses : XSS	medium
3950	Horde < 3.1.4 NLS.php new_lang Parameter XSS	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2007-1473

medium

Tenable Plugins

medium

medium

medium

medium

medium