OSVDB ID: 33084

Title: Horde NLS.php Language Selection new_lang Parameter XSS

Info

Disclosure
Mar 14, 2007

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 The Horde Application Framework contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate input passed to the 'language selection' function in script 'NLS.php'. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified, Vendor Verified
OSVDB: Web Related

Solution

 Upgrade to version 3.1.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Horde Project

Horde Application Framework

 3.1.3
3.1.4
3.1.2
3.1.1
3.0
3.0.x
2.2
2.2.x
2.1
2.0
1.3.x
1.2.x
1.2
1.0.x

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/33084