Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Horde < 3.3.4 / 3.3.5 Multiple Vulnerabilities

High

Synopsis

The remote web server contains a PHP application that is vulnerable to multiple attack vectors.

Description

The version of Horde, Horde Groupware, or Horde Groupware Webmail Edition installed on the remote host is potentially affected by multiple issues :

- A vulnerability in the form library that allows the overwriting of arbitrary local files, subject to the permissions of the web server user. This issue occurs only when the application uses image form fields such as Turba H3 or Ansel.

- Two cross-site scripting vulnerabilities in the preference system and the MIME viewer library.

Solution

Upgrade to Horde version 3.2.5 / 3.3.5 or later.