Unscored severity · published Apr 1, 2011
CVE-2010-3693
Cross-site scripting (XSS) vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary…
–
CVSS
2.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Horde Dynamic IMP (DIMP) before 1.1.5, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via vectors related to displaying mailbox names.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Dynamic Imp · Horde
through 1.1.4; 1.0; 1.0; 1.0; 1.0; 1.0; +6 more · source: NVD
GR
Groupware · Horde
through 1.2.6; 1.0; 1.0; 1.0; 1.0.1; 1.0.2; +25 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3693
Patch
http://bugs.horde.org/ticket/9240
cvs.horde.org
http://cvs.horde.org/diff.php/dimp/docs/CHANGES?rt=horde&r1=1.69.2.82&r2=1.69.2.87&ty=h
Patch
http://git.horde.org/diff.php/groupware/docs/webmail/CHANGES?rt=horde&r1=1.35.2.11&r2=1.35.2.13&ty=h
Patch
http://git.horde.org/diff.php/imp/lib/Views/ListMessages.php?rt=horde-git&r1=b496687e2e71f3ebaecdff5ee49561fbfc1c74cb&r2=48913cf3af81875d6e5c6f32e030c5913f22f25d
Patch
http://lists.horde.org/archives/announce/2010/000561.html
Patch
http://lists.horde.org/archives/announce/2010/000568.html
More from Dynamic Imp
–
CVE-2012-0791
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web…