Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-5917 | First vendor Publication | 2009-01-20 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Cross-site scripting (XSS) vulnerability in the XSS filter (framework/Text_Filter/Filter/xss.php) in Horde Application Framework 3.2.2 and 3.3, when Internet Explorer is being used, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to style attributes. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5917 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13562 | |||
| Oval ID: | oval:org.mitre.oval:def:13562 | ||
| Title: | DSA-1765-1 horde3 -- Multiple vulnerabilities | ||
| Description: | Several vulnerabilities have been found in horde3, the horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0932 Gunnar Wrobel discovered a directory traversal vulnerability, which allows attackers to include and execute arbitrary local files via the driver parameter in Horde_Image. CVE-2008-3330 It was discovered that an attacker could perform a cross-site scripting attack via the contact name, which allows attackers to inject arbitrary html code. This requires that the attacker has access to create contacts. CVE-2008-5917 It was discovered that the horde XSS filter is prone to a cross-site scripting attack, which allows attackers to inject arbitrary html code. This is only exploitable when Internet Explorer is used. For the oldstable distribution, these problems have been fixed in version 3.1.3-4etch5. For the stable distribution, these problems have been fixed in version 3.2.2+debian0-2, which was already included in the lenny release. For the testing distribution and the unstable distribution , these problems have been fixed in version 3.2.2+debian0-2. We recommend that you upgrade your horde3 packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1765-1 CVE-2009-0932 CVE-2008-3330 CVE-2008-5917 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | horde3 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8165 | |||
| Oval ID: | oval:org.mitre.oval:def:8165 | ||
| Title: | DSA-1765 horde3 -- Multiple vulnerabilities | ||
| Description: | Several vulnerabilities have been found in horde3, the horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems: Gunnar Wrobel discovered a directory traversal vulnerability, which allows attackers to include and execute arbitrary local files via the driver parameter in Horde_Image. It was discovered that an attacker could perform a cross-site scripting attack via the contact name, which allows attackers to inject arbitrary html code. This requires that the attacker has access to create contacts. It was discovered that the horde XSS filter is prone to a cross-site scripting attack, which allows attackers to inject arbitrary html code. This is only exploitable when Internet Explorer is used. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1765 CVE-2009-0932 CVE-2008-3330 CVE-2008-5917 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | horde3 |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-04-06 | Name : Fedora Update for horde FEDORA-2010-5483 File : nvt/gb_fedora_2010_5483_horde_fc11.nasl |
| 2010-04-06 | Name : Fedora Update for horde FEDORA-2010-5520 File : nvt/gb_fedora_2010_5520_horde_fc12.nasl |
| 2009-09-15 | Name : Gentoo Security Advisory GLSA 200909-14 (horde horde-imp horde-passwd) File : nvt/glsa_200909_14.nasl |
| 2009-04-15 | Name : Debian Security Advisory DSA 1765-1 (horde3) File : nvt/deb_1765_1.nasl |
| 2009-04-10 | Name : Horde XSS Filter Cross Site Scripting Vulnerability File : nvt/horde_33367.nasl |
| 2009-03-31 | Name : SuSE Security Summary SUSE-SR:2009:007 File : nvt/suse_sr_2009_007.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 53540 | Horde Application Framework framework/Text_Filter/Filter/xss.php Style Attrib... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-5483.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-5520.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-5563.nasl - Type : ACT_GATHER_INFO |
| 2009-09-14 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200909-14.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_horde-090319.nasl - Type : ACT_GATHER_INFO |
| 2009-04-09 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1765.nasl - Type : ACT_GATHER_INFO |
| 2009-03-24 | Name : The remote openSUSE host is missing a security update. File : suse_horde-6099.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:12:28 |
|
| 2024-11-28 12:17:26 |
|
| 2020-05-23 00:22:50 |
|
| 2016-06-29 00:03:10 |
|
| 2016-04-26 18:12:58 |
|
| 2014-02-17 10:47:51 |
|
| 2013-05-11 00:34:12 |
|
