CVE-2008-4182: XSS
First published: Tue Sep 23 2008(Updated: )
Cross-site scripting (XSS) vulnerability in imp/test.php in Horde Turba Contact Manager H3 2.2.1 and other versions before 2.3.1, and possibly other Horde Project products, allows remote attackers to inject arbitrary web script or HTML via the User field in an IMAP session.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Horde Turba Contact Manager | =3.2.2 | |
| Horde Turba Contact Manager | =2.2.1 | |
| Horde Turba Contact Manager | =3.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/31168
- http://packetstormsecurity.org/0809-exploits/turba-xss.txt
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
- http://lists.horde.org/archives/announce/2008/000465.html
- http://secunia.com/advisories/34703
- http://www.debian.org/security/2009/dsa-1770
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45131
Frequently Asked Questions
What is the severity of CVE-2008-4182?
CVE-2008-4182 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2008-4182?
To mitigate CVE-2008-4182, upgrade to Horde Turba versions 2.3.1 or later.
What software is affected by CVE-2008-4182?
CVE-2008-4182 affects Horde Turba Contact Manager H3 versions 2.2.1 to 3.2.2.
Can CVE-2008-4182 be exploited remotely?
Yes, CVE-2008-4182 can be exploited by remote attackers to inject arbitrary web scripts.
What types of attacks are possible with CVE-2008-4182?
CVE-2008-4182 can lead to cross-site scripting (XSS) attacks via user input in an IMAP session.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/horde
- canonical/horde turba contact manager
- version/horde turba contact manager/3.2.2
- version/horde turba contact manager/2.2.1
- version/horde turba contact manager/3.1.1