Vulnerabilities > CVE-2001-1257 - Unspecified vulnerability in Horde IMP

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
horde
nessus
NVD
Published: 2001-07-21
Updated: 2011-03-08

Summary

Cross-site scripting vulnerability in Horde Internet Messaging Program (IMP) before 2.2.6 and 1.2.6 allows remote attackers to execute arbitrary Javascript embedded in an email.

Vulnerable Configurations

Part Description Count
Application
Horde
7

Nessus

NASL familyDebian Local Security Checks
NASL idDEBIAN_DSA-073.NASL
descriptionThe Horde team released version 2.2.6 of IMP (a web-based IMAP mail program) which fixes three security problems. Their release announcement describes them as follows : - A PHPLIB vulnerability allowed an attacker to provide a value for the array element $_PHPLIB[libdir], and thus to get scripts from another server to load and execute. This vulnerability is remotely exploitable. (Horde 1.2.x ships with its own customized version of PHPLIB, which has now been patched to prevent this problem.) - By using tricky encodings of
last seen2020-06-01
modified2020-06-02
plugin id14910
published2004-09-29
reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/14910
titleDebian DSA-073-1 : imp - 3 remote exploits

References