Unscored severity · published Mar 16, 2007
CVE-2007-1473
Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a language selection box, allows remote…
–
CVSS
5.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a language selection box, allows remote attackers to inject arbitrary web script or HTML via the new_lang parameter to login.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.3% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Horde Application Framework · Horde
1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +31 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1473
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1473
Patch
http://lists.horde.org/archives/announce/2007/000315.html
secunia.com
http://secunia.com/advisories/24528
secunia.com
http://secunia.com/advisories/24995
secunia.com
http://secunia.com/advisories/27565
securityreason.com
http://securityreason.com/securityalert/2427
securitytracker.com
http://securitytracker.com/id?1017775
More from Horde Application Framework
–
CVE-2015-7984
Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote…
–
CVE-2014-1691
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP…
–
CVE-2010-3077
Cross-site scripting (XSS) vulnerability in util/icon_browser.php in the Horde Application Framework before 3.3.9 allows remote attackers to inject arbitrary web script or HTML…
–
CVE-2010-3694
Cross-site request forgery (CSRF) vulnerability in the Horde Application Framework before 3.3.9 allows remote attackers to hijack the authentication of unspecified victims for…
–
CVE-2009-3237
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and…