Login Request a demo
Unscored severity · published Nov 9, 2010
CVE-2010-3694
Cross-site request forgery (CSRF) vulnerability in the Horde Application Framework before 3.3.9 allows remote attackers to hijack the authentication of unspecified victims for…
–
CVSS
0.6%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in the Horde Application Framework before 3.3.9 allows remote attackers to hijack the authentication of unspecified victims for requests to a preference form.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Horde Application Framework · Horde
through 3.3.8; 1.0.3; 1.1.1; 1.3.0; 1.3.1; 1.3.2; +34 more · source: NVD
Affected product
HA
Horde Application Framework
Horde
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3694
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3694
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050408.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050423.html
Patch
http://lists.horde.org/archives/announce/2010/000557.html
secunia.com
http://secunia.com/advisories/42140
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=630687
More from Horde Application Framework
–
CVE-2015-7984
Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote…
–
CVE-2014-1691
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP…
–
CVE-2010-3077
Cross-site scripting (XSS) vulnerability in util/icon_browser.php in the Horde Application Framework before 3.3.9 allows remote attackers to inject arbitrary web script or HTML…
–
CVE-2009-3237
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and…
–
CVE-2007-1474
Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users to delete arbitrary files…