Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.

This version upgrade of horde3-dimp to 4.3.11 fixes several issues (including security related flaws, CVE-2012-0791) and adds new features.

This version upgrade of horde3-dimp to 1.1.8 fixes several issues (including security related flaws, CVE-2012-0791) and adds new features.

Warning: Official end of life for horde 3 is April 2012!

Changes in horde3 :

  - version 3.3.13

  - Fixed a XSS vulnerability (CVE-2012-0909).

  - Added support for resetting passwords in LDAP.

  - Fixed compatibility with Firefox 10. 

Changes in horde3-imp :

  - Fixed XSS vulnerabilities (CVE-2012-0791). 

  - Version 4.3.11

Changes in horde3-dimp :

  - version 1.1.8

  - Fixed XSS vulnerabilities (CVE-2012-0791).

Multiple cross-site scripting (XSS) vulnerabilities were discovered in IMP, the webmail component in the Horde framework. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML via various crafted parameters.

ID	Name	Product	Family	Severity
75860	openSUSE Security Update : horde3-imp (horde3-imp-5830)	Nessus	SuSE Local Security Checks	medium
75859	openSUSE Security Update : horde3-dimp (horde3-dimp-5829)	Nessus	SuSE Local Security Checks	medium
74548	openSUSE Security Update : horde3 / horde3-dimp / horde3-imp (openSUSE-2012-112)	Nessus	SuSE Local Security Checks	medium
74547	openSUSE Security Update : horde4-imp (openSUSE-2012-111)	Nessus	SuSE Local Security Checks	medium
59763	Debian DSA-2485-1 : imp4 - XSS	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-0791

medium

Tenable Plugins

medium

medium

medium

medium

medium