Vulnerability in Horde
CVE-2006-3548
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen).
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.021 (81.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 81.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.021 · newest: 0.021 · change: 0.000
Affected products
- Horde — versions 3.0, 3.0.1, 3.0.2
References
- lists.grok.org.uk/pipermail/full-disclosure/2006-July/047687.html (mailing-list)
- exchange.xforce.ibmcloud.com/vulnerabilities/27589 (vdb-entry)
- lists.horde.org/archives/announce/2006/000287.html (Patch)
- www.securityfocus.com/bid/18845 (vdb-entry)
- www.vupen.com/english/advisories/2006/2694 (vdb-entry)
- secunia.com/advisories/21459 (third-party-advisory)
- www.novell.com/linux/security/advisories/2006_19_sr.html (vendor-advisory)
- secunia.com/advisories/27565 (third-party-advisory)
- securitytracker.com/id (Exploit, Patch, vdb-entry)
- lists.horde.org/archives/announce/2006/000288.html (Patch)