XSS in Horde Groupware

CVE-2010-3695

Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchma…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.050 (91.3th percentile) — read the EPSS interpretation.

Affected products

Horde Groupware — versions 1.0, 1.0.1, 1.0.2
Horde Imp — versions 2.0, 2.2, 2.2.1
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (Exploit, vdb-entry, x_refsource_BID)
secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
secalert@redhat.com (x_refsource_CONFIRM, Patch)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ)
secalert@redhat.com (mailing-list, Exploit, x_refsource_FULLDISC)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (x_refsource_CONFIRM)