| Vulnerability Name: | CVE-2010-3695 (CCN-62059) |
| Assigned: | 2010-09-27 |
| Published: | 2010-09-27 |
| Updated: | 2019-06-18 |
| Summary: | Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchmail_prefs_save action, related to the Fetchmail configuration.
|
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): Low
Availibility (A): None |
|
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.9 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:TF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None |
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.9 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:TF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None |
|
| Vulnerability Type: | CWE-79
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: CCN
Type: BugTraq Mailing List, Mon Sep 27 2010
XSS in Horde IMP <=4.3.7, fetchmailprefs.php
Source: FULLDISC
Type: Exploit
20100927 XSS in Horde IMP <=4.3.7, fetchmailprefs.php
Source: CONFIRM
Type: Exploit, Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584
Source: MITRE
Type: CNA
CVE-2010-3695
Source: CONFIRM
Type: UNKNOWN
http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde&r1=1.699.2.424&r2=1.699.2.430&ty=h
Source: CONFIRM
Type: UNKNOWN
http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde&r1=1.35.2.11&r2=1.35.2.13&ty=h
Source: CCN
Type: Horde GIT Repository
Diff for imp/fetchmailprefs.php between version 1.39.4.10 and 1.39.4.11
Browse
* Help
Help
* Log in
Log in
Diff for imp/fetchmailprefs.php between version 1.39.4.10 and 1.39.4.11
Source: CONFIRM
Type: Patch
http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde&r1=1.39.4.10&r2=1.39.4.11
Source: MLIST
Type: Patch
[announce] 20100928 IMP H3 (4.3.8) (final)
Source: MLIST
Type: UNKNOWN
[announce] 20100928 Horde Groupware Webmail Edition 1.2.7 (final)
Source: MLIST
Type: Exploit, Patch
[oss-security] 20100930 Re: CVE request: Horde Gollem <1.1.2 XSS in view.php
Source: MLIST
Type: Exploit, Patch
[oss-security] 20100930 Re: CVE request: Horde Gollem <1.1.2 XSS in view.php
Source: MLIST
Type: Patch
[oss-security] 20101001 Re: CVE request: Horde Gollem <1.1.2 XSS in view.php
Source: CCN
Type: SA41627
Horde IMP fm_id Cross-Site Scripting Vulnerability
Source: SECUNIA
Type: Vendor Advisory
41627
Source: SECUNIA
Type: Vendor Advisory
43896
Source: SREASON
Type: UNKNOWN
8170
Source: DEBIAN
Type: UNKNOWN
DSA-2204
Source: DEBIAN
Type: DSA-2204
imp4 -- insufficient input sanitising
Source: CCN
Type: Horde Web site
The Horde Project
Source: CCN
Type: OSVDB ID: 68261
Horde IMP fetchmailprefs.php fm_id Parameter XSS
Source: BUGTRAQ
Type: UNKNOWN
20100927 XSS in Horde IMP <=4.3.7, fetchmailprefs.php
Source: BID
Type: Exploit
43515
Source: CCN
Type: BID-43515
Horde IMP Webmail 'fetchmailprefs.php' HTML Injection Vulnerability
Source: VUPEN
Type: Vendor Advisory
ADV-2010-2513
Source: VUPEN
Type: Vendor Advisory
ADV-2011-0769
Source: CONFIRM
Type: Exploit, Patch
https://bugzilla.redhat.com/show_bug.cgi?id=641069
Source: XF
Type: UNKNOWN
hordeimp-fmid-xss(62059)
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:horde:imp:2.0:*:*:*:*:*:*:*OR cpe:/a:horde:imp:2.2:*:*:*:*:*:*:*OR cpe:/a:horde:imp:2.2.1:*:*:*:*:*:*:*OR cpe:/a:horde:imp:2.2.2:*:*:*:*:*:*:*OR cpe:/a:horde:imp:2.2.3:*:*:*:*:*:*:*OR cpe:/a:horde:imp:2.2.4:*:*:*:*:*:*:*OR cpe:/a:horde:imp:2.2.5:*:*:*:*:*:*:*OR cpe:/a:horde:imp:2.2.6:*:*:*:*:*:*:*OR cpe:/a:horde:imp:2.2.7:*:*:*:*:*:*:*OR cpe:/a:horde:imp:2.2.8:*:*:*:*:*:*:*OR cpe:/a:horde:imp:2.3:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.0:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.1:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.1.2:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.2:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.2.1:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.2.2:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.2.3:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.2.4:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.2.5:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.2.6:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.2.7:*:*:*:*:*:*:*OR cpe:/a:horde:imp:3.2.7:rc1:*:*:*:*:*:*OR cpe:/a:horde:imp:4.0:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.0.1:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.0.2:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.0.3:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.0.4:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.1.3:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.1.5:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.1.6:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.2:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.2.1:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.2.2:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.1:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.2:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.3:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.4:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.5:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.6:*:*:*:*:*:*:*OR cpe:/a:horde:imp:*:*:*:*:*:*:*:* (Version <= 4.3.7)
Configuration 2:
cpe:/a:horde:groupware:1.0:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.0:rc1:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.0:rc2:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.0.1:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.0.2:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.0.3:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.0.4:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.0.5:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.0.6:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.0.7:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.0.8:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.1:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.1:rc1:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.1:rc2:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.1:rc3:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.1:rc4:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.1.1:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.1.2:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.1.3:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.1.4:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.1.5:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.1.6:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.2:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.2:rc1:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.2.1:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.2.2:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.2.3:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.2.3:rc1:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.2.4:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:1.2.5:*:*:*:*:*:*:*OR cpe:/a:horde:groupware:*:*:*:*:*:*:*:* (Version <= 1.2.6)
Configuration CCN 1:
cpe:/a:horde:imp:4.0.4:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.1.5:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.2:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.2.1:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.0.3:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.0.2:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.0.1:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.0:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.6:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.3:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.4:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.5:*:*:*:*:*:*:*OR cpe:/a:horde:imp:4.3.7:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| Oval Definitions |
|
| BACK |