CVE-2009-3237: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebarwidth parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mimedrivers.php).
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3237?
CVE-2009-3237 has been classified with moderate severity due to its potential for cross-site scripting attacks.
How do I fix CVE-2009-3237?
To fix CVE-2009-3237, update the Horde Application Framework and related products to versions 3.2.5 or 3.3.5 and later.
What versions of Horde are affected by CVE-2009-3237?
CVE-2009-3237 affects Horde Application Framework versions 3.2 before 3.2.5, 3.3 before 3.3.5, and multiple versions of Groupware and Webmail Edition prior to their respective fixed versions.
Can CVE-2009-3237 lead to data breaches?
Yes, CVE-2009-3237 can potentially lead to data breaches if an attacker successfully exploits the cross-site scripting vulnerabilities.
What types of attacks can CVE-2009-3237 facilitate?
CVE-2009-3237 can facilitate attacks that involve injecting arbitrary web scripts or HTML into affected applications.