Cross-site scripting (XSS) vulnerability in services/obrowser/index.php in Horde 3.2 and Turba 2.2 allows remote attackers to inject arbitrary web script or HTML via the contact name.

This update of horde fixes the following vulnerabilities :

  - CVE-2008-1284: directory traversal allows authenticated     user to access and execute arbitrary files

  - CVE-2008-3330: remotely exploitable XSS

  - CVE-2008-3824: remotely exploitable XSS

Several vulnerabilities have been found in horde3, the horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0932     Gunnar Wrobel discovered a directory traversal     vulnerability, which allows attackers to include and     execute arbitrary local files via the driver parameter     in Horde_Image.

  - CVE-2008-3330     It was discovered that an attacker could perform a     cross-site scripting attack via the contact name, which     allows attackers to inject arbitrary html code. This     requires that the attacker has access to create     contacts.

  - CVE-2008-5917     It was discovered that the horde XSS filter is prone to     a cross-site scripting attack, which allows attackers to     inject arbitrary html code. This is only exploitable     when Internet Explorer is used.

ID	Name	Product	Family	Severity
39984	openSUSE Security Update : horde (horde-311)	Nessus	SuSE Local Security Checks	medium
36119	Debian DSA-1765-1 : horde3 - Multiple vulnerabilities	Nessus	Debian Local Security Checks	medium
34959	openSUSE 10 Security Update : horde (horde-5791)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2008-3330

medium

Tenable Plugins

medium

medium

medium