CVE-2009-3701: XSS

Published Dec 21, 2009
·
Updated

Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to (1) phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to the PHPSELF variable.

Affected Software

61 affected components
Horde Application Framework<=3.3.5
Horde Application Framework=2.0
Horde Application Framework=2.1
Horde Application Framework=2.1.3
Horde Application Framework=2.2
Horde Application Framework=2.2.1
Horde Application Framework=2.2.3
Horde Application Framework=2.2.4
Horde Application Framework=2.2.4_rc1
Horde Application Framework=2.2.5
Horde Application Framework=2.2.6
Horde Application Framework=3.0
Horde Application Framework=3.0.1
Horde Application Framework=3.0.2
Horde Application Framework=3.0.3
Horde Application Framework=3.0.4
Horde Application Framework=3.0.6
Horde Application Framework=3.0.7
Horde Application Framework=3.0.8
Horde Application Framework=3.0.9
Horde Application Framework=3.1
Horde Application Framework=3.1.1
Horde Application Framework=3.2
Horde Application Framework=3.2.1
Horde Application Framework=3.2.2
Horde Application Framework=3.2.3
Horde Application Framework=3.2.4
Horde Application Framework=3.3
Horde Application Framework=3.3.1
Horde Application Framework=3.3.2
Horde Application Framework=3.3.3
Horde Application Framework=3.3.4
Horde Groupware Webmail Edition<=1.2.4
Horde Groupware Webmail Edition=1.0
Horde Groupware Webmail Edition=1.0.1
Horde Groupware Webmail Edition=1.0.2
Horde Groupware Webmail Edition=1.0.3
Horde Groupware Webmail Edition=1.0.4
Horde Groupware Webmail Edition=1.0.5
Horde Groupware Webmail Edition=1.1
Horde Groupware Webmail Edition=1.1.1
Horde Groupware Webmail Edition=1.1.2
Horde Groupware Webmail Edition=1.1.3
Horde Groupware Webmail Edition=1.1.4
Horde Groupware Webmail Edition=1.1.5
Horde Groupware Webmail Edition=1.2
Horde Groupware Webmail Edition=1.2-rc1
Horde Groupware Webmail Edition=1.2.1
Horde Groupware Webmail Edition=1.2.2
Horde Groupware Webmail Edition=1.2.3
Horde Groupware Webmail Edition=1.0-rc1
Horde Groupware Webmail Edition=1.0-rc2
Horde Groupware Webmail Edition=1.0.6
Horde Groupware Webmail Edition=1.0.7
Horde Groupware Webmail Edition=1.0.8
Horde Groupware Webmail Edition=1.1-rc1
Horde Groupware Webmail Edition=1.1-rc2
Horde Groupware Webmail Edition=1.1-rc3
Horde Groupware Webmail Edition=1.1-rc4
Horde Groupware Webmail Edition=1.1.6
Horde Groupware Webmail Edition=1.2.3-rc1

Remediation

Patch Available

http://lists.horde.org/archives/announce/2009/000529.html

Patch Available

http://marc.info/?l=horde-announce&m=126101076422179&w=2

Patch Available

http://www.vupen.com/english/advisories/2009/3549

Patch Available

http://www.vupen.com/english/advisories/2009/3572

Event History

Dec 21, 2009
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2009-3701?

CVE-2009-3701 has a CVSS score that indicates it is a medium severity vulnerability, primarily affecting web applications.

2

How do I fix CVE-2009-3701?

To fix CVE-2009-3701, update your Horde Application Framework or Horde Groupware to the latest version, specifically 3.3.6 or later.

3

Which versions are affected by CVE-2009-3701?

CVE-2009-3701 affects multiple versions of Horde Application Framework before 3.3.6 and Horde Groupware before 1.2.5.

4

What type of vulnerability is CVE-2009-3701?

CVE-2009-3701 is classified as a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary scripts.

5

Can CVE-2009-3701 be exploited remotely?

Yes, CVE-2009-3701 can be exploited remotely by attackers who gain access to the administration interface.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203