CVE-2009-3701
Priority
Low
Description
Multiple cross-site scripting (XSS) vulnerabilities in the administration
interface in Horde Application Framework before 3.3.6, Horde Groupware
before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote
attackers to inject arbitrary web script or HTML via the PATH_INFO to (1)
phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to
the PHP_SELF variable.
interface in Horde Application Framework before 3.3.6, Horde Groupware
before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote
attackers to inject arbitrary web script or HTML via the PATH_INFO to (1)
phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to
the PHP_SELF variable.
Package
| Upstream: | released (3.3.6) |
| Ubuntu 8.04 LTS (Hardy Heron): | ignored (reached end-of-life) |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected (3.3.6+debian0-2) |
| Ubuntu 11.04 (Natty Narwhal): | not-affected (3.3.6+debian0-2) |
| Ubuntu 11.10 (Oneiric Ocelot): | not-affected (3.3.6+debian0-2) |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected (3.3.6+debian0-2) |
Patches:
| Vendor: | http://www.debian.org/security/2010/dsa-1966 |