The version of Horde installed on the remote host fails to validate input to the 'url' parameter of the 'services/go.php' script before using it in dynamically-generated content.  An unauthenticated attacker may be able to leverage this issue to inject arbitrary HTML and script code into a user's browser. 

In addition, similar cross-site scripting issues reportedly exist with the 'module' parameter of the 'services/help/index.php' script and the 'name' parameter of the 'services/problem.php' script.

Several remote vulnerabilities have been discovered in the Horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-3548     Moritz Naumann discovered that Horde allows remote     attackers to inject arbitrary web script or HTML in the     context of a logged in user (cross site scripting).

      This vulnerability applies to oldstable (sarge) only.

  - CVE-2006-3549     Moritz Naumann discovered that Horde does not properly     restrict its image proxy, allowing remote attackers to     use the server as a proxy.

      This vulnerability applies to oldstable (sarge) only.

  - CVE-2006-4256     Marc Ruef discovered that Horde allows remote attackers     to include web pages from other sites, which could be     useful for phishing attacks.

      This vulnerability applies to oldstable (sarge) only.

  - CVE-2007-1473     Moritz Naumann discovered that Horde allows remote     attackers to inject arbitrary web script or HTML in the     context of a logged in user (cross site scripting).

      This vulnerability applies to both stable (etch) and oldstable       (sarge).

  - CVE-2007-1474     iDefense discovered that the cleanup cron script in     Horde allows local users to delete arbitrary files.

      This vulnerability applies to oldstable (sarge) only.

This update fixes the following two security issues in the Horde Application Framework :

  - CVE-2006-3548: Multiple cross-site scripting (XSS)     vulnerabilities allow remote attackers to inject     arbitrary web script or HTML via a (1) JavaScript URI or     an external (2) http, (3) https, or (4) ftp URI in the     url parameter in services/go.php (aka the dereferrer),     (5) a JavaScript URI in the module parameter in     services/help (aka the help viewer), and (6) the name     parameter in services/problem.php (aka the problem     reporting screen).

  - CVE-2006-3549: services/go.php does not properly     restrict its image proxy capability, which allows remote     attackers to perform 'Web tunneling' attacks and use the     server as a proxy via (1) http, (2) https, and (3) ftp     URL in the url parameter, which is requested from the     server.

リモートホストにインストールされているHordeのバージョンは、動的に生成されたコンテンツで使用する前に、「services/go.php」スクリプトの「url」パラメーターへの入力検証をサニタイズできません。認証されていない攻撃者はこの問題を利用して、ユーザーのブラウザに任意のHTMLおよびスクリプトコードを注入できる可能性があります。 

さらに、報告によれば、「services/help/index.php」スクリプトの「module」パラメーターおよび「services/problem.php」スクリプトの「name」パラメーターにも、類似したクロスサイトスクリプティングの問題が存在します。

遠端主機上安裝的 Horde 版本未驗證「services/go.php」指令碼中「url」參數的輸入內容，便將其用於動態產生的內容。未經驗證的攻擊者可以利用此問題，在使用者的瀏覽器中注入任意 HTML 和指令碼。 

此外，據報「services/help/index.php」的「module」參數和「services/problem.php」的「name」參數存在類似的跨網站指令碼問題。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
22004	Horde < 3.0.11 / 3.1.2 Multiple Script XSS	Nessus	CGI abuses : XSS	2006/7/5	2022/4/11	medium
28151	Debian DSA-1406-1 : horde3 - several vulnerabilities	Nessus	Debian Local Security Checks	2007/11/12	2021/1/4	medium
27265	openSUSE 10 Security Update : horde (horde-1868)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	medium
22004	Horde < 3.0.11 / 3.1.2 複数スクリプトのXSS	Nessus	CGI abuses : XSS	2006/7/5	2022/4/11	medium
22004	Horde < 3.0.11 / 3.1.2 多個指令碼 XSS	Nessus	CGI abuses : XSS	2006/7/5	2022/4/11	medium

检测

插件搜索

medium

medium

medium

medium

medium