CVE-2007-1473: XSS

Published Mar 16, 2007

Updated

Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a language selection box, allows remote attackers to inject arbitrary web script or HTML via the newlang parameter to login.php.

Affected Software

37 affected components

Horde Horde Application Framework=1.2.3

Horde Horde Application Framework=2.0

Horde Horde Application Framework=1.2.4

Horde Horde Application Framework=3.0.0

Horde Horde Application Framework=2.2.5

Horde Horde Application Framework=3.0.4

Horde Horde Application Framework=3.1.0

Horde Horde Application Framework=3.1.2

Horde Horde Application Framework=2.2.9

Horde Horde Application Framework=2.2.3

Horde Horde Application Framework=1.2.1

Horde Horde Application Framework=1.3.3

Horde Horde Application Framework=3.0.5

Horde Horde Application Framework=3.0.10

Horde Horde Application Framework=3.0.1

Horde Horde Application Framework=1.2.6

Horde Horde Application Framework=2.2.8

Horde Horde Application Framework=2.2.6

Horde Horde Application Framework=1.2.0

Horde Horde Application Framework=1.2.7

Horde Horde Application Framework=3.1.1

Horde Horde Application Framework=3.0.8

Horde Horde Application Framework=2.2.7

Horde Horde Application Framework=3.0.3

Horde Horde Application Framework=3.0.6

Horde Horde Application Framework=2.2

Horde Horde Application Framework=2.2.1

Horde Horde Application Framework=3.0.9

Horde Horde Application Framework=1.3.4

Horde Horde Application Framework=3.1.3

Horde Horde Application Framework=2.2.4

Horde Horde Application Framework=3.0.7

Horde Horde Application Framework=1.2.2

Horde Horde Application Framework=1.2.8

Horde Horde Application Framework=1.2.5

Horde Horde Application Framework=2.1

Horde Horde Application Framework=3.0.2

Remediation

Patch Available

http://lists.horde.org/archives/announce/2007/000315.html

Event History

Mar 16, 2007

CVE Published

09:19 PM

Mar 17, 2007

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1473?

CVE-2007-1473 is classified as a medium severity Cross-site Scripting (XSS) vulnerability.

How do I fix CVE-2007-1473?

To mitigate CVE-2007-1473, upgrade to Horde Framework version 3.1.4 RC1 or later.

Who is affected by CVE-2007-1473?

CVE-2007-1473 affects users of Horde Framework versions before 3.1.4 RC1 that include a language selection box on the login page.

What type of attack can CVE-2007-1473 facilitate?

CVE-2007-1473 can facilitate remote attackers in injecting arbitrary web scripts or HTML through the new_lang parameter.

When was CVE-2007-1473 discovered?

CVE-2007-1473 was discovered in 2007 and has been documented since then.