CVE-2012-0791: XSS

Q: What is the severity of CVE-2012-0791?

CVE-2012-0791 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.

Q: How do I fix CVE-2012-0791?

To fix CVE-2012-0791, upgrade to Horde IMP version 5.0.18 or higher and Horde Groupware Webmail Edition version 4.0.6 or higher.

Q: What types of attacks are possible due to CVE-2012-0791?

CVE-2012-0791 allows attackers to inject arbitrary web scripts or HTML, which can lead to phishing or session hijacking attacks.

Q: Which versions of Horde are affected by CVE-2012-0791?

CVE-2012-0791 affects Horde IMP versions prior to 5.0.18 and Horde Groupware Webmail Edition versions prior to 4.0.6.

Q: Can I identify if my system is affected by CVE-2012-0791?

Yes, if you are running any version of Horde IMP earlier than 5.0.18 or Horde Groupware Webmail Edition earlier than 4.0.6, your system is vulnerable.

Published Jan 24, 2012

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information.

Affected Software

128 affected components

Horde Dynamic IMP<=5.0.17

Horde Dynamic IMP=1.0

Horde Dynamic IMP=1.0-alpha

Horde Dynamic IMP=1.0-rc1

Horde Dynamic IMP=1.0-rc2

Horde Dynamic IMP=1.0-rc3

Horde Dynamic IMP=1.1

Horde Dynamic IMP=1.1-rc1

Horde Dynamic IMP=1.1-rc2

Horde Dynamic IMP=1.1.1

Horde Dynamic IMP=1.1.2

Horde Dynamic IMP=1.1.3

Horde Dynamic IMP=1.1.4

Horde Dynamic IMP=1.1.5

Horde Dynamic IMP=1.1.6

Horde Dynamic IMP=5.0

Horde Dynamic IMP=5.0.1

Horde Dynamic IMP=5.0.2

Horde Dynamic IMP=5.0.3

Horde Dynamic IMP=5.0.4

Horde Dynamic IMP=5.0.5

Horde Dynamic IMP=5.0.6

Horde Dynamic IMP=5.0.7

Horde Dynamic IMP=5.0.8

Horde Dynamic IMP=5.0.9

Horde Dynamic IMP=5.0.10

Horde Dynamic IMP=5.0.11

Horde Dynamic IMP=5.0.12

Horde Dynamic IMP=5.0.13

Horde Dynamic IMP=5.0.14

Horde Dynamic IMP=5.0.15

Horde Dynamic IMP=5.0.16

Horde IMP=2.0

Horde IMP=2.2

Horde IMP=2.2.1

Horde IMP=2.2.2

Horde IMP=2.2.3

Horde IMP=2.2.4

Horde IMP=2.2.5

Horde IMP=2.2.6

Horde IMP=2.2.7

Horde IMP=2.2.8

Horde IMP=2.3

Horde IMP=3.0

Horde IMP=3.1

Horde IMP=3.1.2

Horde IMP=3.2

Horde IMP=3.2.1

Horde IMP=3.2.2

Horde IMP=3.2.3

Horde IMP=3.2.4

Horde IMP=3.2.5

Horde IMP=3.2.6

Horde IMP=3.2.7

Horde IMP=3.2.7-rc1

Horde IMP=4.0

Horde IMP=4.0.1

Horde IMP=4.0.2

Horde IMP=4.0.3

Horde IMP=4.0.4

Horde IMP=4.1.3

Horde IMP=4.1.5

Horde IMP=4.1.6

Horde IMP=4.2

Horde IMP=4.2.1

Horde IMP=4.2.2

Horde IMP=4.3

Horde IMP=4.3.1

Horde IMP=4.3.2

Horde IMP=4.3.3

Horde IMP=4.3.4

Horde IMP=4.3.5

Horde IMP=4.3.6

Horde IMP=4.3.7

Horde IMP=4.3.8

Horde IMP=4.3.9

Horde IMP=5.0

Horde IMP=5.0-alpha1

Horde IMP=5.0-beta1

Horde IMP=5.0-rc1

Horde IMP=5.0-rc2

Horde IMP=5.0.1

Horde IMP=5.0.2

Horde IMP=5.0.3

Horde IMP=5.0.4-git

Horde Groupware Webmail Edition<=4.0.5

Horde Groupware Webmail Edition=1.0

Horde Groupware Webmail Edition=1.0-rc1

Horde Groupware Webmail Edition=1.0-rc2

Horde Groupware Webmail Edition=1.0.1

Horde Groupware Webmail Edition=1.0.2

Horde Groupware Webmail Edition=1.0.3

Horde Groupware Webmail Edition=1.0.4

Horde Groupware Webmail Edition=1.0.5

Horde Groupware Webmail Edition=1.0.6

Horde Groupware Webmail Edition=1.0.7

Horde Groupware Webmail Edition=1.0.8

Horde Groupware Webmail Edition=1.1

Horde Groupware Webmail Edition=1.1-rc1

Horde Groupware Webmail Edition=1.1-rc2

Horde Groupware Webmail Edition=1.1-rc3

Horde Groupware Webmail Edition=1.1-rc4

Horde Groupware Webmail Edition=1.1.1

Horde Groupware Webmail Edition=1.1.2

Horde Groupware Webmail Edition=1.1.3

Horde Groupware Webmail Edition=1.1.4

Horde Groupware Webmail Edition=1.1.5

Horde Groupware Webmail Edition=1.1.6

Horde Groupware Webmail Edition=1.2

Horde Groupware Webmail Edition=1.2-rc1

Horde Groupware Webmail Edition=1.2.1

Horde Groupware Webmail Edition=1.2.2

Horde Groupware Webmail Edition=1.2.3

Horde Groupware Webmail Edition=1.2.3-rc1

Horde Groupware Webmail Edition=1.2.4

Horde Groupware Webmail Edition=1.2.5

Horde Groupware Webmail Edition=1.2.6

Horde Groupware Webmail Edition=1.2.7

Horde Groupware Webmail Edition=1.2.8

Horde Groupware Webmail Edition=1.2.9

Horde Groupware Webmail Edition=1.2.10

Horde Groupware Webmail Edition=4.0

Horde Groupware Webmail Edition=4.0-rc1

Horde Groupware Webmail Edition=4.0-rc2

Horde Groupware Webmail Edition=4.0.1

Horde Groupware Webmail Edition=4.0.2

Horde Groupware Webmail Edition=4.0.3

Horde Groupware Webmail Edition=4.0.4

Event History

Jan 24, 2012

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0791?

CVE-2012-0791 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2012-0791?

To fix CVE-2012-0791, upgrade to Horde IMP version 5.0.18 or higher and Horde Groupware Webmail Edition version 4.0.6 or higher.

What types of attacks are possible due to CVE-2012-0791?

CVE-2012-0791 allows attackers to inject arbitrary web scripts or HTML, which can lead to phishing or session hijacking attacks.

Which versions of Horde are affected by CVE-2012-0791?

CVE-2012-0791 affects Horde IMP versions prior to 5.0.18 and Horde Groupware Webmail Edition versions prior to 4.0.6.

Can I identify if my system is affected by CVE-2012-0791?