CVE-2006-3548: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen).
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3548?
CVE-2006-3548 is considered a medium severity vulnerability due to the potential for remote code execution through cross-site scripting exploits.
How do I fix CVE-2006-3548?
To fix CVE-2006-3548, upgrade the Horde Application Framework to version 3.1.2 or later.
What applications are affected by CVE-2006-3548?
CVE-2006-3548 affects Horde Application Framework versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1.
Can CVE-2006-3548 be exploited by unauthenticated users?
Yes, CVE-2006-3548 can be exploited by unauthenticated users allowing them to inject scripts into web pages.
What types of attacks can CVE-2006-3548 facilitate?
CVE-2006-3548 can facilitate various types of attacks, including session hijacking and phishing through cross-site scripting.