Cross-site scripting (XSS) vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter.

It was discovered that sork-passwd-h3, a Horde3 module for users to change their password, is prone to a cross-site scripting attack via the backend parameter.

The remote host is affected by the vulnerability described in GLSA-200909-14 (Horde: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Horde:
    Gunnar Wrobel reported an input sanitation and directory traversal     flaw in framework/Image/Image.php, related to the 'Horde_Image driver     name' (CVE-2009-0932).
    Gunnar Wrobel reported that data sent     to horde/services/portal/cloud_search.php is not properly sanitized     before used in the output (CVE-2009-0931).
    It was reported     that data sent to framework/Text_Filter/Filter/xss.php is not properly     sanitized before used in the output (CVE-2008-5917).
    Horde Passwd: David Wharton reported that data sent via the 'backend'     parameter to passwd/main.php is not properly sanitized before used in     the output (CVE-2009-2360).
    Horde IMP: Gunnar Wrobel reported that data sent to smime.php, pgp.php,     and message.php is not properly sanitized before used in the output     (CVE-2009-0930).
  Impact :

    A remote authenticated attacker could exploit these vulnerabilities to     execute arbitrary PHP files on the server, or disclose the content of     arbitrary files, both only if the file is readable to the web server. A     remote authenticated attacker could conduct Cross-Site Scripting     attacks. NOTE: Some Cross-Site Scripting vectors are limited to the     usage of Microsoft Internet Explorer.
  Workaround :

    There is no known workaround at this time.

The installation of Horde is using the Passwd module which provides support for changing passwords. The installed version of this module is earlier than 3.1.1. Such versions are reportedly affected by a cross-site scripting vulnerability that affects the 'backend' parameter of the 'main.php' script. An attacker can exploit this to execute arbitrary script code in the browser of an authenticated user.


ID	Name	Product	Family	Severity
44694	Debian DSA-1829-1 : sork-passwd-h3 - insufficient input sanitising	Nessus	Debian Local Security Checks	medium
40961	GLSA-200909-14 : Horde: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
5092	Horde Passwd Module < 3.1.1 XSS	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2009-2360

medium

Tenable Plugins

medium

medium

medium