XSS in Horde Application Framework
CVE-2009-4363
Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not properly handle data: URIs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via data:text/html values for the HREF attribute of an A element in an HTML e-mail message. NOTE: the vendor states that the issue is caused by "an XSS vulnerability in Firefox browsers."
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.014 (69.1th percentile) — read the EPSS interpretation.
Affected products
- Horde Application_framework — versions 2.0, 2.1, 2.1.3
- Horde Groupware — versions 1.0, 1.0.1, 1.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_MLIST, Patch)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Patch)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_CONFIRM, Exploit)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Patch)
- cve@mitre.org (x_refsource_CONFIRM, Exploit)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)