CVE-2010-4778: XSS
First published: Fri Apr 01 2011(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmail_prefs_save action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Horde | <=4.3.7 | |
| Horde | =2.0 | |
| Horde | =2.2 | |
| Horde | =2.2.1 | |
| Horde | =2.2.2 | |
| Horde | =2.2.3 | |
| Horde | =2.2.4 | |
| Horde | =2.2.5 | |
| Horde | =2.2.6 | |
| Horde | =2.2.7 | |
| Horde | =2.2.8 | |
| Horde | =2.3 | |
| Horde | =3.0 | |
| Horde | =3.1 | |
| Horde | =3.1.2 | |
| Horde | =3.2 | |
| Horde | =3.2.1 | |
| Horde | =3.2.2 | |
| Horde | =3.2.3 | |
| Horde | =3.2.4 | |
| Horde | =3.2.5 | |
| Horde | =3.2.6 | |
| Horde | =3.2.7 | |
| Horde | =3.2.7-rc1 | |
| Horde | =4.0 | |
| Horde | =4.0.1 | |
| Horde | =4.0.2 | |
| Horde | =4.0.3 | |
| Horde | =4.0.4 | |
| Horde | =4.1.3 | |
| Horde | =4.1.5 | |
| Horde | =4.1.6 | |
| Horde | =4.2 | |
| Horde | =4.2.1 | |
| Horde | =4.2.2 | |
| Horde | =4.3 | |
| Horde | =4.3.1 | |
| Horde | =4.3.2 | |
| Horde | =4.3.3 | |
| Horde | =4.3.4 | |
| Horde | =4.3.5 | |
| Horde | =4.3.6 | |
| Horde Groupware Webmail Edition | <=1.2.6 | |
| Horde Groupware Webmail Edition | =1.0 | |
| Horde Groupware Webmail Edition | =1.0-rc1 | |
| Horde Groupware Webmail Edition | =1.0-rc2 | |
| Horde Groupware Webmail Edition | =1.0.1 | |
| Horde Groupware Webmail Edition | =1.0.2 | |
| Horde Groupware Webmail Edition | =1.0.3 | |
| Horde Groupware Webmail Edition | =1.0.4 | |
| Horde Groupware Webmail Edition | =1.0.5 | |
| Horde Groupware Webmail Edition | =1.0.6 | |
| Horde Groupware Webmail Edition | =1.0.7 | |
| Horde Groupware Webmail Edition | =1.0.8 | |
| Horde Groupware Webmail Edition | =1.1 | |
| Horde Groupware Webmail Edition | =1.1-rc1 | |
| Horde Groupware Webmail Edition | =1.1-rc2 | |
| Horde Groupware Webmail Edition | =1.1-rc3 | |
| Horde Groupware Webmail Edition | =1.1-rc4 | |
| Horde Groupware Webmail Edition | =1.1.1 | |
| Horde Groupware Webmail Edition | =1.1.2 | |
| Horde Groupware Webmail Edition | =1.1.3 | |
| Horde Groupware Webmail Edition | =1.1.4 | |
| Horde Groupware Webmail Edition | =1.1.5 | |
| Horde Groupware Webmail Edition | =1.1.6 | |
| Horde Groupware Webmail Edition | =1.2 | |
| Horde Groupware Webmail Edition | =1.2-rc1 | |
| Horde Groupware Webmail Edition | =1.2.1 | |
| Horde Groupware Webmail Edition | =1.2.2 | |
| Horde Groupware Webmail Edition | =1.2.3 | |
| Horde Groupware Webmail Edition | =1.2.3-rc1 | |
| Horde Groupware Webmail Edition | =1.2.4 | |
| Horde Groupware Webmail Edition | =1.2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2010-4778?
CVE-2010-4778 has a medium severity rating due to its potential for remote code execution via cross-site scripting (XSS).
How do I fix CVE-2010-4778?
To fix CVE-2010-4778, upgrade Horde IMP to version 4.3.8 or later, or Horde Groupware Webmail Edition to version 1.2.7 or later.
What are the affected versions of Horde IMP for CVE-2010-4778?
Affected versions of Horde IMP include 2.0 through 4.3.7.
What types of attacks are possible due to CVE-2010-4778?
CVE-2010-4778 allows attackers to inject arbitrary web scripts or HTML, leading to potential phishing or data theft.
Is there a patch available for CVE-2010-4778?
Yes, patches are included in the updated versions of Horde IMP and Horde Groupware that resolve the vulnerabilities.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/horde
- canonical/horde
- version/horde/4.3.7
- version/horde/2.0
- version/horde/2.2
- version/horde/2.2.1
- version/horde/2.2.2
- version/horde/2.2.3
- version/horde/2.2.4
- version/horde/2.2.5
- version/horde/2.2.6
- version/horde/2.2.7
- version/horde/2.2.8
- version/horde/2.3
- version/horde/3.0
- version/horde/3.1
- version/horde/3.1.2
- version/horde/3.2
- version/horde/3.2.1
- version/horde/3.2.2
- version/horde/3.2.3
- version/horde/3.2.4
- version/horde/3.2.5
- version/horde/3.2.6
- version/horde/3.2.7
- version/horde/3.2.7-rc1
- version/horde/4.0
- version/horde/4.0.1
- version/horde/4.0.2
- version/horde/4.0.3
- version/horde/4.0.4
- version/horde/4.1.3
- version/horde/4.1.5
- version/horde/4.1.6
- version/horde/4.2
- version/horde/4.2.1
- version/horde/4.2.2
- version/horde/4.3
- version/horde/4.3.1
- version/horde/4.3.2
- version/horde/4.3.3
- version/horde/4.3.4
- version/horde/4.3.5
- version/horde/4.3.6
- canonical/horde groupware webmail edition
- version/horde groupware webmail edition/1.2.6
- version/horde groupware webmail edition/1.0
- version/horde groupware webmail edition/1.0-rc1
- version/horde groupware webmail edition/1.0-rc2
- version/horde groupware webmail edition/1.0.1
- version/horde groupware webmail edition/1.0.2
- version/horde groupware webmail edition/1.0.3
- version/horde groupware webmail edition/1.0.4
- version/horde groupware webmail edition/1.0.5
- version/horde groupware webmail edition/1.0.6
- version/horde groupware webmail edition/1.0.7
- version/horde groupware webmail edition/1.0.8
- version/horde groupware webmail edition/1.1
- version/horde groupware webmail edition/1.1-rc1
- version/horde groupware webmail edition/1.1-rc2
- version/horde groupware webmail edition/1.1-rc3
- version/horde groupware webmail edition/1.1-rc4
- version/horde groupware webmail edition/1.1.1
- version/horde groupware webmail edition/1.1.2
- version/horde groupware webmail edition/1.1.3
- version/horde groupware webmail edition/1.1.4
- version/horde groupware webmail edition/1.1.5
- version/horde groupware webmail edition/1.1.6
- version/horde groupware webmail edition/1.2
- version/horde groupware webmail edition/1.2-rc1
- version/horde groupware webmail edition/1.2.1
- version/horde groupware webmail edition/1.2.2
- version/horde groupware webmail edition/1.2.3
- version/horde groupware webmail edition/1.2.3-rc1
- version/horde groupware webmail edition/1.2.4
- version/horde groupware webmail edition/1.2.5