CVE-2010-4778: XSS

Q: What is the severity of CVE-2010-4778?

CVE-2010-4778 has a medium severity rating due to its potential for remote code execution via cross-site scripting (XSS).

Q: How do I fix CVE-2010-4778?

To fix CVE-2010-4778, upgrade Horde IMP to version 4.3.8 or later, or Horde Groupware Webmail Edition to version 1.2.7 or later.

Q: What are the affected versions of Horde IMP for CVE-2010-4778?

Affected versions of Horde IMP include 2.0 through 4.3.7.

Q: What types of attacks are possible due to CVE-2010-4778?

CVE-2010-4778 allows attackers to inject arbitrary web scripts or HTML, leading to potential phishing or data theft.

Q: Is there a patch available for CVE-2010-4778?

Yes, patches are included in the updated versions of Horde IMP and Horde Groupware that resolve the vulnerabilities.

Published Apr 1, 2011

Updated

Multiple cross-site scripting (XSS) vulnerabilities in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka fmusername), (2) password (aka fmpassword), or (3) server (aka fmserver) field in a fetchmailprefssave action, related to the Fetchmail configuration, a different issue than CVE-2010-3695. NOTE: some of these details are obtained from third party information.

Affected Software

73 affected components

Horde IMP<=4.3.7

Horde IMP=2.0

Horde IMP=2.2

Horde IMP=2.2.1

Horde IMP=2.2.2

Horde IMP=2.2.3

Horde IMP=2.2.4

Horde IMP=2.2.5

Horde IMP=2.2.6

Horde IMP=2.2.7

Horde IMP=2.2.8

Horde IMP=2.3

Horde IMP=3.0

Horde IMP=3.1

Horde IMP=3.1.2

Horde IMP=3.2

Horde IMP=3.2.1

Horde IMP=3.2.2

Horde IMP=3.2.3

Horde IMP=3.2.4

Horde IMP=3.2.5

Horde IMP=3.2.6

Horde IMP=3.2.7

Horde IMP=3.2.7-rc1

Horde IMP=4.0

Horde IMP=4.0.1

Horde IMP=4.0.2

Horde IMP=4.0.3

Horde IMP=4.0.4

Horde IMP=4.1.3

Horde IMP=4.1.5

Horde IMP=4.1.6

Horde IMP=4.2

Horde IMP=4.2.1

Horde IMP=4.2.2

Horde IMP=4.3

Horde IMP=4.3.1

Horde IMP=4.3.2

Horde IMP=4.3.3

Horde IMP=4.3.4

Horde IMP=4.3.5

Horde IMP=4.3.6

Horde Groupware Webmail Edition<=1.2.6

Horde Groupware Webmail Edition=1.0

Horde Groupware Webmail Edition=1.0-rc1

Horde Groupware Webmail Edition=1.0-rc2

Horde Groupware Webmail Edition=1.0.1

Horde Groupware Webmail Edition=1.0.2

Horde Groupware Webmail Edition=1.0.3

Horde Groupware Webmail Edition=1.0.4

Horde Groupware Webmail Edition=1.0.5

Horde Groupware Webmail Edition=1.0.6

Horde Groupware Webmail Edition=1.0.7

Horde Groupware Webmail Edition=1.0.8

Horde Groupware Webmail Edition=1.1

Horde Groupware Webmail Edition=1.1-rc1

Horde Groupware Webmail Edition=1.1-rc2

Horde Groupware Webmail Edition=1.1-rc3

Horde Groupware Webmail Edition=1.1-rc4

Horde Groupware Webmail Edition=1.1.1

Horde Groupware Webmail Edition=1.1.2

Horde Groupware Webmail Edition=1.1.3

Horde Groupware Webmail Edition=1.1.4

Horde Groupware Webmail Edition=1.1.5

Horde Groupware Webmail Edition=1.1.6

Horde Groupware Webmail Edition=1.2

Horde Groupware Webmail Edition=1.2-rc1

Horde Groupware Webmail Edition=1.2.1

Horde Groupware Webmail Edition=1.2.2

Horde Groupware Webmail Edition=1.2.3

Horde Groupware Webmail Edition=1.2.3-rc1

Horde Groupware Webmail Edition=1.2.4

Horde Groupware Webmail Edition=1.2.5

Remediation

Patch Available

http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde&r1=1.39.4.10&r2=1.39.4.11

Event History

Apr 1, 2011

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-4778?

CVE-2010-4778 has a medium severity rating due to its potential for remote code execution via cross-site scripting (XSS).

How do I fix CVE-2010-4778?

To fix CVE-2010-4778, upgrade Horde IMP to version 4.3.8 or later, or Horde Groupware Webmail Edition to version 1.2.7 or later.

What are the affected versions of Horde IMP for CVE-2010-4778?