CVE-2009-0930: XSS
First published: Tue Mar 17 2009(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 4.2.2 and 4.3.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) smime.php, (2) pgp.php, and (3) message.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Horde IMP | =4.0 | |
| Horde IMP | <=4.1.5 | |
| Horde IMP | <=4.0.4 | |
| Horde IMP | <=4.0.3 | |
| Horde IMP | <=4.1.4 | |
| Horde IMP | <=4.2.1 | |
| Horde IMP | <=4.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.horde.org/archives/announce/2009/000485.html
- http://www.securityfocus.com/bid/33492
- http://lists.horde.org/archives/announce/2009/000484.html
- http://cvs.horde.org/co.php/imp/docs/CHANGES?r=1.699.2.301.2.3
- http://secunia.com/advisories/33719
- http://cvs.horde.org/co.php/imp/docs/CHANGES?r=1.699.2.375
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
- http://secunia.com/advisories/34418
- http://www.debian.org/security/2009/dsa-1770
- http://secunia.com/advisories/34703
Frequently Asked Questions
What is the severity of CVE-2009-0930?
CVE-2009-0930 is classified as a medium severity vulnerability due to the potential for exploitation via cross-site scripting.
How do I fix CVE-2009-0930?
To fix CVE-2009-0930, upgrade to Horde IMP version 4.2.2 or later, or 4.3.3 or later.
What kind of attacks can exploit CVE-2009-0930?
CVE-2009-0930 can be exploited by remote attackers to inject arbitrary web scripts or HTML into specific PHP files.
Which versions of Horde IMP are affected by CVE-2009-0930?
CVE-2009-0930 affects Horde IMP versions prior to 4.2.2 and 4.3.3.
What are the impacted files in CVE-2009-0930?
The impacted files in CVE-2009-0930 include smime.php, pgp.php, and message.php.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/debian
- canonical/horde imp
- version/horde imp/4.0
- version/horde imp/4.1.5
- version/horde imp/4.0.4
- version/horde imp/4.0.3
- version/horde imp/4.1.4
- version/horde imp/4.2.1
- version/horde imp/4.0.2