Vulnerabilidad en Horde IMP (CVE-2010-3695)
Gravedad CVSS v2.0:
MEDIA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
31/03/2011
Última modificación:
11/04/2025
Descripción
Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en fetchmailprefs.php in Horde IMP anterior a v4.3.8, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro fm_id en una acción fetchmail_prefs_save, relacionado con la configuración de Fetchmail.
Impacto
Puntuación base 2.0
4.30
Gravedad 2.0
MEDIA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:horde:imp:*:*:*:*:*:*:*:* | 4.3.7 (incluyendo) | |
| cpe:2.3:a:horde:imp:2.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:2.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:2.2.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:2.2.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:2.2.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:2.2.4:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:2.2.5:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:2.2.6:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:2.2.7:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:2.2.8:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:2.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:3.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:3.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:horde:imp:3.1.2:*:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0379.html
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584
- http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde&r1=1.699.2.424&r2=1.699.2.430&ty=h
- http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde&r1=1.35.2.11&r2=1.35.2.13&ty=h
- http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde&r1=1.39.4.10&r2=1.39.4.11
- http://lists.horde.org/archives/announce/2010/000558.html
- http://lists.horde.org/archives/announce/2010/000568.html
- http://openwall.com/lists/oss-security/2010/09/30/7
- http://openwall.com/lists/oss-security/2010/09/30/8
- http://openwall.com/lists/oss-security/2010/10/01/6
- http://secunia.com/advisories/41627
- http://secunia.com/advisories/43896
- http://securityreason.com/securityalert/8170
- http://www.debian.org/security/2011/dsa-2204
- http://www.securityfocus.com/archive/1/513992/100/0/threaded
- http://www.securityfocus.com/bid/43515
- http://www.vupen.com/english/advisories/2010/2513
- http://www.vupen.com/english/advisories/2011/0769
- https://bugzilla.redhat.com/show_bug.cgi?id=641069
- http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0379.html
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598584
- http://cvs.horde.org/diff.php/imp/docs/CHANGES?rt=horde&r1=1.699.2.424&r2=1.699.2.430&ty=h
- http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde&r1=1.35.2.11&r2=1.35.2.13&ty=h
- http://git.horde.org/diff.php/imp/fetchmailprefs.php?rt=horde&r1=1.39.4.10&r2=1.39.4.11
- http://lists.horde.org/archives/announce/2010/000558.html
- http://lists.horde.org/archives/announce/2010/000568.html
- http://openwall.com/lists/oss-security/2010/09/30/7
- http://openwall.com/lists/oss-security/2010/09/30/8
- http://openwall.com/lists/oss-security/2010/10/01/6
- http://secunia.com/advisories/41627
- http://secunia.com/advisories/43896
- http://securityreason.com/securityalert/8170
- http://www.debian.org/security/2011/dsa-2204
- http://www.securityfocus.com/archive/1/513992/100/0/threaded
- http://www.securityfocus.com/bid/43515
- http://www.vupen.com/english/advisories/2010/2513
- http://www.vupen.com/english/advisories/2011/0769
- https://bugzilla.redhat.com/show_bug.cgi?id=641069