4.3
CVSSv2

CVE-2010-3077

Published: 09/11/2010 Updated: 12/07/2011
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 435
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Summary

Cross-site scripting (XSS) vulnerability in util/icon_browser.php in the Horde Application Framework prior to 3.3.9 allows remote malicious users to inject arbitrary web script or HTML via the subdir parameter.

Vulnerable Product Search on Vulmon Subscribe to Product

horde horde application framework 1.0.3

horde horde application framework 1.1.1

horde horde application framework 2.0

horde horde application framework 2.1

horde horde application framework 2.2.6

horde horde application framework 2.2.7

horde horde application framework 3.0.3

horde horde application framework 3.0.9

horde horde application framework 3.1.3

horde horde application framework 3.1.4

horde horde application framework 3.2

horde horde application framework 3.2.1

horde horde application framework 3.3.5

horde horde application framework 3.3.6

horde horde application framework 3.1.8

horde horde application framework 3.0.5

horde horde application framework 3.0.8

horde horde application framework 1.3.2

horde horde application framework 1.3.5

horde horde application framework 2.2.4

horde horde application framework 2.2.5

horde horde application framework 3.0.1

horde horde application framework 3.0.2

horde horde application framework 3.1.1

horde horde application framework 3.1.2

horde horde application framework 3.3.3

horde horde application framework 3.3.4

horde horde application framework 3.2.2

horde horde application framework 3.0

horde horde application framework 3.0.6

horde horde application framework 3.1

horde horde application framework 3.0.4

horde horde application framework 1.3.3

horde horde application framework 1.3.4

horde horde application framework 2.2

horde horde application framework 2.2.1

horde horde application framework 2.2.8

horde horde application framework 2.2.9

horde horde application framework 3.0.10

horde horde application framework 3.0.11

horde horde application framework 3.1.5

horde horde application framework 3.1.6

horde horde application framework 3.2.3

horde horde application framework 3.2.4

horde horde application framework 3.3

horde horde application framework 3.3.7

horde horde application framework

horde horde application framework 1.3.0

horde horde application framework 1.3.1

horde horde application framework 2.2.3

horde horde application framework 2.2.2

horde horde application framework 3.0.12

horde horde application framework 3.1.7

horde horde application framework 3.1.9

horde horde application framework 3.3.1

horde horde application framework 3.3.2

horde horde application framework 3.2.5

horde horde application framework 3.0.7

Vendor Advisories

It was discovered that horde3, the horde web application framework, is prone to a cross-site scripting attack and a cross-site request forgery For the oldstable distribution (lenny), these problems have been fixed in version 322+debian0-2+lenny3 For the stable distribution (squeeze), these problems have been fixed in version 338+debian0-2, wh ...

Exploits

source: wwwsecurityfocuscom/bid/43001/info Horde Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may hel ...