CVE-2009-3701

Priority
Low
Description
Multiple cross-site scripting (XSS) vulnerabilities in the administration
interface in Horde Application Framework before 3.3.6, Horde Groupware
before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote
attackers to inject arbitrary web script or HTML via the PATH_INFO to (1)
phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to
the PHP_SELF variable.
References
Package
Upstream:released (3.3.6)
Ubuntu 12.04 LTS (Precise Pangolin):not-affected (3.3.6+debian0-2)
Patches:
Vendor:http://www.debian.org/security/2010/dsa-1966
More Information

Valid XHTML 1.0 Strict

Updated: 2015-07-29 20:36:56 UTC (commit 9756)