CVE-2009-3701

Priority
Low
Description
Multiple cross-site scripting (XSS) vulnerabilities in the administration
interface in Horde Application Framework before 3.3.6, Horde Groupware
before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote
attackers to inject arbitrary web script or HTML via the PATH_INFO to (1)
phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to
the PHP_SELF variable.
References
Package
Upstream:released (3.3.6)
Ubuntu 8.04 LTS (Hardy Heron):ignored (reached end-of-life)
Ubuntu 10.04 LTS (Lucid Lynx):not-affected (3.3.6+debian0-2)
Ubuntu 11.04 (Natty Narwhal):not-affected (3.3.6+debian0-2)
Ubuntu 11.10 (Oneiric Ocelot):not-affected (3.3.6+debian0-2)
Ubuntu 12.04 LTS (Precise Pangolin):not-affected (3.3.6+debian0-2)
Patches:
Vendor:http://www.debian.org/security/2010/dsa-1966
More Information

Valid XHTML 1.0 Strict

Updated: 2012-06-01 15:20:17 UTC (commit 5347)