CVE-2008-5917 — Cross-site Scripting in Application Framework

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.5%
top 33.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Horde Application Framework
Timeline
PublishedJan 21
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in the XSS filter (framework/Text_Filter/Filter/xss.php) in Horde Application Framework 3.2.2 and 3.3, when Internet Explorer is being used, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to style attributes.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDhorde/application_framework3.2.2, 3.3+1

🔴Vulnerability Details

1
GHSA
GHSA-6hmc-j3q7-53ff: Cross-site scripting (XSS) vulnerability in the XSS filter (framework/Text_Filter/Filter/xss↗2022-05-17
▶

📋Vendor Advisories

1
Red Hat
horde: IE-specific XSS via image style attribute↗
▶

💬Community

1
Bugzilla
CVE-2008-5917 horde: IE-specific XSS via image style attribute↗2009-01-20
▶