CVE-2009-3237 | Vulnetix

CVE-2009-3237 PUBLISHED CVSS 4.300000190734863 MEDIUM

Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebar_width parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mime_drivers.php).

EPSS 2.27% · 82.9th percentile

Risk Scores

CVSS 2.0

4.300000190734863

EPSS Score

2.27%

82.9th percentile

Affected Products

Vendor	Product	Versions
horde	horde_application_framework	3.3, 3.2.1, 3.2.2
horde	horde_groupware	1.2, 1.1.1, 1.1.2
n/a	n/a	n/a
horde	groupware	1.1, 1.1, 1.1

Timeline

Sep 17, 2009 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 21, 2022 EPSS Score
Jul 15, 2022 EPSS Score
Sep 6, 2022 EPSS Score
Oct 29, 2022 EPSS Score
Dec 21, 2022 EPSS Score
Feb 12, 2023 EPSS Score
Apr 6, 2023 EPSS Score
May 30, 2023 EPSS Score
Jul 22, 2023 EPSS Score

References

http://bugs.horde.org/ticket/?id=8311 url
[horde-announce] 20090914 [announce] Horde Groupware Webmail Edition 1.1.6 (final) mailing-list
[horde-announce] 20090914 [announce] [SECURITY] Horde 3.3.5 (final) mailing-list
[horde-announce] 20090914 [announce] Horde Groupware 1.2.4 (final) mailing-list
36665 third-party-advisory
http://bugs.horde.org/ticket/?id=8399 url
horde-mimeviewer-xss(53200) vdb
58109 vdb
[horde-announce] 20090914 [announce] Horde Groupware Webmail Edition 1.2.4 (final) mailing-list
58108 vdb
[horde-announce] 20090914 [announce] [SECURITY] Horde 3.2.5 (final) mailing-list
[horde-announce] 20090914 [announce] Horde Groupware 1.1.6 (final) mailing-list
https://nvd.nist.gov/vuln/detail/CVE-2009-3237 advisory

Open in Interactive Console →