Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2009-3701
HistoryDec 21, 2009 - 4:30 p.m.

CVE-2009-3701

2009-12-2116:30:00
CWE-79
[email protected]
web.nvd.nist.gov

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.033 Low

EPSS

Percentile

91.4%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to the PHP_SELF variable.

Affected configurations

NVD
Node
hordeapplication_frameworkRange≤3.3.5
OR
hordeapplication_frameworkMatch2.0
OR
hordeapplication_frameworkMatch2.1
OR
hordeapplication_frameworkMatch2.1.3
OR
hordeapplication_frameworkMatch2.2
OR
hordeapplication_frameworkMatch2.2.1
OR
hordeapplication_frameworkMatch2.2.3
OR
hordeapplication_frameworkMatch2.2.4
OR
hordeapplication_frameworkMatch2.2.4_rc1
OR
hordeapplication_frameworkMatch2.2.5
OR
hordeapplication_frameworkMatch2.2.6
OR
hordeapplication_frameworkMatch3.0
OR
hordeapplication_frameworkMatch3.0.1
OR
hordeapplication_frameworkMatch3.0.2
OR
hordeapplication_frameworkMatch3.0.3
OR
hordeapplication_frameworkMatch3.0.4
OR
hordeapplication_frameworkMatch3.0.6
OR
hordeapplication_frameworkMatch3.0.7
OR
hordeapplication_frameworkMatch3.0.8
OR
hordeapplication_frameworkMatch3.0.9
OR
hordeapplication_frameworkMatch3.1
OR
hordeapplication_frameworkMatch3.1.1
OR
hordeapplication_frameworkMatch3.2
OR
hordeapplication_frameworkMatch3.2.1
OR
hordeapplication_frameworkMatch3.2.2
OR
hordeapplication_frameworkMatch3.2.3
OR
hordeapplication_frameworkMatch3.2.4
OR
hordeapplication_frameworkMatch3.3
OR
hordeapplication_frameworkMatch3.3.1
OR
hordeapplication_frameworkMatch3.3.2
OR
hordeapplication_frameworkMatch3.3.3
OR
hordeapplication_frameworkMatch3.3.4
OR
hordegroupwareRange≤1.2.4
OR
hordegroupwareMatch1.0
OR
hordegroupwareMatch1.0.1
OR
hordegroupwareMatch1.0.2
OR
hordegroupwareMatch1.0.3
OR
hordegroupwareMatch1.0.4
OR
hordegroupwareMatch1.0.5
OR
hordegroupwareMatch1.1
OR
hordegroupwareMatch1.1.1
OR
hordegroupwareMatch1.1.2
OR
hordegroupwareMatch1.1.3
OR
hordegroupwareMatch1.1.4
OR
hordegroupwareMatch1.1.5
OR
hordegroupwareMatch1.2
OR
hordegroupwareMatch1.2rc1
OR
hordegroupwareMatch1.2.1
OR
hordegroupwareMatch1.2.2
OR
hordegroupwareMatch1.2.3
Node
hordegroupwareRange≤1.2.4
OR
hordegroupwareMatch1.0
OR
hordegroupwareMatch1.0rc1
OR
hordegroupwareMatch1.0rc2
OR
hordegroupwareMatch1.0.1
OR
hordegroupwareMatch1.0.2
OR
hordegroupwareMatch1.0.3
OR
hordegroupwareMatch1.0.4
OR
hordegroupwareMatch1.0.5
OR
hordegroupwareMatch1.0.6
OR
hordegroupwareMatch1.0.7
OR
hordegroupwareMatch1.0.8
OR
hordegroupwareMatch1.1
OR
hordegroupwareMatch1.1rc1
OR
hordegroupwareMatch1.1rc2
OR
hordegroupwareMatch1.1rc3
OR
hordegroupwareMatch1.1rc4
OR
hordegroupwareMatch1.1.1
OR
hordegroupwareMatch1.1.2
OR
hordegroupwareMatch1.1.3
OR
hordegroupwareMatch1.1.4
OR
hordegroupwareMatch1.1.5
OR
hordegroupwareMatch1.1.6
OR
hordegroupwareMatch1.2
OR
hordegroupwareMatch1.2rc1
OR
hordegroupwareMatch1.2.1
OR
hordegroupwareMatch1.2.2
OR
hordegroupwareMatch1.2.3
OR
hordegroupwareMatch1.2.3rc1

Related

cve 1
securityvulns 3
prion 1
seebug 3
exploitpack 1
packetstorm 1
ubuntucve 1
cvelist 1
exploitdb 1
nessus 5
openvas 6
debian 1
osv 1
fedora 3
cve
cve
CVE-2009-3701
2009-12-21 16:30:00
securityvulns
securityvulns
[ISecAuditors Security Advisories] Horde 3.3.5 "PHP_SELF" Cross-Site Scripting vulnerability
2009-12-17 00:00:00
[SECURITY] [DSA 1966-1] New horde3 packages fix cross-site scripting
2010-01-07 00:00:00
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
2010-01-07 00:00:00
prion
prion
Cross site scripting
2009-12-21 16:30:00
seebug
seebug
Horde应用框架管理界面PHP_SELF参数跨站脚本漏洞
2009-12-23 00:00:00
Horde 3.3.5 ""PHP_SELF"" XSS vulnerability
2009-12-17 00:00:00
Horde 3.3.5 - "PHP_SELF" XSS vulnerability
2014-07-01 00:00:00
exploitpack
exploitpack
Horde 3.3.5 - PHP_SELF Cross-Site Scripting
2009-12-17 00:00:00
packetstorm
packetstorm
Horde 3.3.5 Cross Site Scripting
2009-12-17 00:00:00
ubuntucve
ubuntucve
CVE-2009-3701
2009-12-21 00:00:00
cvelist
cvelist
CVE-2009-3701
2009-12-21 16:00:00
exploitdb
exploitdb
Horde 3.3.5 - 'PHP_SELF' Cross-Site Scripting
2009-12-17 00:00:00
nessus
nessus
Debian DSA-1966-1 : horde3 - insufficient input sanitising
2010-02-24 00:00:00
openSUSE Security Update : horde (horde-1947)
2010-02-15 00:00:00
Fedora 11 : horde-3.3.6-1.fc11 (2010-5483)
2010-07-01 00:00:00
openvas
openvas
Debian Security Advisory DSA 1966-1 (horde3)
2010-01-11 00:00:00
Debian: Security Advisory (DSA-1966-1)
2010-01-11 00:00:00
Fedora Update for horde FEDORA-2010-5483
2010-04-06 00:00:00
debian
debian
[SECURITY] [DSA 1966-1] New horde3 packages fix cross-site scripting
2010-01-07 10:33:23
osv
osv
horde3 - cross-site scripting
2010-01-07 00:00:00
fedora
fedora
[SECURITY] Fedora 11 Update: horde-3.3.6-1.fc11
2010-04-01 01:40:32
[SECURITY] Fedora 12 Update: horde-3.3.6-1.fc12
2010-04-01 01:51:02
[SECURITY] Fedora 13 Update: horde-3.3.6-1.fc13
2010-04-01 17:20:56

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.033 Low

EPSS

Percentile

91.4%

JSON
Related for NVD:CVE-2009-3701
cve1securityvulns3prion1seebug3exploitpack1packetstorm1ubuntucve1cvelist1exploitdb1nessus5openvas6debian1osv1fedora3