CVE-2009-3701

Description

Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to the PHP_SELF variable.

References

http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0388.html

http://marc.info/?l=horde-announce&m=126100750018478&w=2

http://marc.info/?l=horde-announce&m=126101076422179&w=2

http://secunia.com/advisories/37709

http://secunia.com/advisories/37823

http://securitytracker.com/id?1023365

https://exchange.xforce.ibmcloud.com/vulnerabilities/54817

http://www.vupen.com/english/advisories/2009/3549

http://www.vupen.com/english/advisories/2009/3572

Details

Risk Information

CVSS v2