Horde < 3.3.4 / 3.3.5 Multiple Vulnerabilities

High Nessus Network Monitor Plugin ID 5171


The remote web server contains a PHP application that is vulnerable to multiple attack vectors.


The version of Horde, Horde Groupware, or Horde Groupware Webmail Edition installed on the remote host is potentially affected by multiple issues :

- A vulnerability in the form library that allows the overwriting of arbitrary local files, subject to the permissions of the web server user. This issue occurs only when the application uses image form fields such as Turba H3 or Ansel.

- Two cross-site scripting vulnerabilities in the preference system and the MIME viewer library.


Upgrade to Horde version 3.2.5 / 3.3.5 or later.

See Also


Plugin Details

Severity: High

ID: 5171

Family: CGI

Published: 2009/09/14

Modified: 2016/01/15

Dependencies: 1442

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C


Base Score: 7.3

Temporal Score: 6.8


Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

Patch Publication Date: 2009/09/14

Vulnerability Publication Date: 2009/09/14

Reference Information

BID: 36382