NVD

Id
51486  
Name
CVE-2009-4363  
Description
Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not properly handle data: URIs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via data:text/html values for the HREF attribute of an A element in an HTML e-mail message. NOTE: the vendor states that the issue is caused by "an XSS vulnerability in Firefox browsers."  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2009-12-21  
Modified Date
2012-01-06  
Seq
2009-4363  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
261169 51486 CVE-2009-4363 http://bugs.horde.org/ticket/8715  View
261170 51486 CVE-2009-4363 http://bugs.horde.org/view.php?actionID=view_file&type=patch&file=0002-Bug-8715-Fix-XSS-vulnerability%5B1%5D.patch&ticket=8715  View
261171 51486 CVE-2009-4363 http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.559&r2=1.515.2.589&ty=h  View
261172 51486 CVE-2009-4363 [announce] 20091215 Horde 3.3.6 (final)  View
261173 51486 CVE-2009-4363 [announce] 20091216 Horde Groupware 1.2.5 (final)  View
261174 51486 CVE-2009-4363 [announce] 20091217 Horde Groupware Webmail Edition 1.2.5 (final)  View
261175 51486 CVE-2009-4363 1023365  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
44218 JVNDB-2009-005225 Horde Application Framework などにおけるクロスサイトスクリプティング攻撃を実行される脆弱性 Horde Application Framework、Horde Groupware および Horde Groupware Webmail Edition の Text_Filter/lib/Horde/Text/Filter/Xss.php は、データ : URI を適切に処理しないため、クロスサイトスクリプティング攻撃を実行される脆弱性が存在します。 CVE-2009-4363 41794 CVE-2009-4363 51486 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-005225.html 2009-12-15 2012-09-25 View