CVE-2009-3237 — Vulnetix

CVE-2009-3237 PUBLISHED CVSS 4.300000190734863 MEDIUM

Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebar_width parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mime_drivers.php).

EPSS 0.76% · 73.7th percentile

Risk Scores

CVSS 2.0

4.300000190734863

EPSS Score

0.76%

73.7th percentile

Affected Products

Vendor	Product	Versions
horde	horde_application_framework	3.3, 3.2.1, 3.2.2
horde	horde_groupware	1.2, 1.1.1, 1.1.2
n/a	n/a	n/a
horde	groupware	1.1, 1.1, 1.1

Timeline

Sep 17, 2009 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Oct 26, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 9, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 3, 2023 EPSS Score
May 25, 2023 EPSS Score

References

[horde-announce] 20090914 [announce] Horde Groupware 1.2.4 (final) mailing-list
36665 third-party-advisory
http://bugs.horde.org/ticket/?id=8311 url
http://bugs.horde.org/ticket/?id=8399 url
[horde-announce] 20090914 [announce] Horde Groupware Webmail Edition 1.1.6 (final) mailing-list
horde-mimeviewer-xss(53200) vdb
58109 vdb
[horde-announce] 20090914 [announce] Horde Groupware Webmail Edition 1.2.4 (final) mailing-list
58108 vdb
[horde-announce] 20090914 [announce] [SECURITY] Horde 3.2.5 (final) mailing-list
[horde-announce] 20090914 [announce] [SECURITY] Horde 3.3.5 (final) mailing-list
[horde-announce] 20090914 [announce] Horde Groupware 1.1.6 (final) mailing-list
https://nvd.nist.gov/vuln/detail/CVE-2009-3237 advisory

Open in Interactive Console →