CVE-2010-0463
published 2010-01-29CVE-2010-0463: Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for…
PriorityP423medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
1.94%
77.7th percentile
Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| horde | imp | <= 4.3.6 | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
| horde | imp | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
imp: privacy compromise via DNS prefetching in web mail
vendor_redhat·2010-01-23·CVSS 5.0
CVE-2010-0463 [MEDIUM] imp: privacy compromise via DNS prefetching in web mail
imp: privacy compromise via DNS prefetching in web mail
Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
VulDB
Horde IMP up to 4.3.6 information disclosure (Nessus ID 47842 / ID 118703)
vuldb·2026-04-29·CVSS 5.0
CVE-2010-0463 [MEDIUM] Horde IMP up to 4.3.6 information disclosure (Nessus ID 47842 / ID 118703)
A vulnerability categorized as problematic has been discovered in Horde IMP. Affected is an unknown function. Such manipulation leads to information disclosure.
This vulnerability is referenced as CVE-2010-0463. It is possible to launch the attack remotely. No exploit is available.
GHSA
GHSA-g9xm-ww44-j6j9: Horde IMP 4
ghsa_unreviewed·2022-05-02
CVE-2010-0463 [MEDIUM] CWE-200 GHSA-g9xm-ww44-j6j9: Horde IMP 4
Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
No detection rules found.
No public exploits indexed.
http://bugs.horde.org/ticket/8836https://exchange.xforce.ibmcloud.com/vulnerabilities/56052https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmailhttp://bugs.horde.org/ticket/8836https://exchange.xforce.ibmcloud.com/vulnerabilities/56052https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail
2010-01-29
Published