CVE-2010-3077: XSS
Cross-site scripting (XSS) vulnerability in util/iconbrowser.php in the Horde Application Framework before 3.3.9 allows remote attackers to inject arbitrary web script or HTML via the subdir parameter.
Other sources
Moritz Naumann reported: [1] http://seclists.org/fulldisclosure/2010/Sep/82
a deficiency in the way Horde framework sanitized user-provided 'subdir' parameter, when composing final path to the image file. A remote, unauthenticated user could use this flaw to conduct cross-site scripting attacks (execute arbitrary HTML or scripting code) by providing a specially-crafted URL to the running Horde framework instance.
Upstream patch: [2] http://git.horde.org/diff.php/horde/util/iconbrowser.php?rt=horde-git&r1=a978a35c3e95e784253508fd4333d2fbb64830b6&r2=9342addbd2b95f184f230773daa4faf5ef6d65e9
Sample public URL by Moritz to demonstrate the issue: [3] [pathtohorde]/util/iconbrowser.php?subdir=<body onload="alert('XSS')">&app=horde
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3077?
CVE-2010-3077 is classified as a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2010-3077?
To fix CVE-2010-3077, upgrade the Horde Application Framework to version 3.3.9 or later.
Which versions of the Horde Application Framework are affected by CVE-2010-3077?
CVE-2010-3077 affects all Horde Application Framework versions prior to 3.3.9 and certain earlier versions.
What type of vulnerability is CVE-2010-3077?
CVE-2010-3077 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary web scripts.
Can I still use versions before 3.3.9 with CVE-2010-3077?
Using versions before 3.3.9 while CVE-2010-3077 is unpatched poses a security risk.