FKIE_CVE-2006-3548

Vulnerability from fkie_nvd - Published: 2006-07-13 00:05 - Updated: 2026-06-16 22:27
Severity
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen).
References
cve@mitre.orghttp://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047687.html
cve@mitre.orghttp://lists.horde.org/archives/announce/2006/000287.htmlPatch
cve@mitre.orghttp://lists.horde.org/archives/announce/2006/000288.htmlPatch
cve@mitre.orghttp://moritz-naumann.com/adv/0011/hordemulti/0011.txtExploit, Patch, Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/20954
cve@mitre.orghttp://secunia.com/advisories/21459
cve@mitre.orghttp://secunia.com/advisories/27565
cve@mitre.orghttp://securityreason.com/securityalert/1229
cve@mitre.orghttp://securitytracker.com/id?1016442Exploit, Patch
cve@mitre.orghttp://www.debian.org/security/2007/dsa-1406
cve@mitre.orghttp://www.novell.com/linux/security/advisories/2006_19_sr.html
cve@mitre.orghttp://www.securityfocus.com/archive/1/439255/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/18845
cve@mitre.orghttp://www.vupen.com/english/advisories/2006/2694
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/27589
af854a3a-2127-422b-91ae-364da2661108http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047687.html
af854a3a-2127-422b-91ae-364da2661108http://lists.horde.org/archives/announce/2006/000287.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://lists.horde.org/archives/announce/2006/000288.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://moritz-naumann.com/adv/0011/hordemulti/0011.txtExploit, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/20954
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/21459
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27565
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/1229
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1016442Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2007/dsa-1406
af854a3a-2127-422b-91ae-364da2661108http://www.novell.com/linux/security/advisories/2006_19_sr.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/439255/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/18845
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/2694
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/27589
Impacted products
Vendor Product Version
horde horde 3.0
horde horde 3.0.1
horde horde 3.0.2
horde horde 3.0.3
horde horde 3.0.4
horde horde 3.0.4_rc1
horde horde 3.0.4_rc2
horde horde 3.0.6
horde horde 3.0.7
horde horde 3.0.8
horde horde 3.0.9
horde horde 3.1
horde horde 3.1.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:horde:horde:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF82BE80-C62C-4E1A-8AB9-5773E49142B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "74DEABE1-B6C4-4C6F-A098-D5BC9F3C65A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C8E486E1-3BC7-444A-8BBB-6571CCF44E0B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE8E2B1E-C3C7-466D-982C-36FC51D0BE9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "76E3B91F-F391-4126-832C-C5582F5D6FB1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.0.4_rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2912428D-9A74-48C2-8866-669355CAB535",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.0.4_rc2:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A17589E-AAD1-432A-A5E3-623A8EF66572",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FA1F0BF-6F17-4062-86B0-83EEDA5EAC94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "505DFF07-4F63-4A0E-87E4-DC899F345307",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B313A4C-12CE-4CA9-8036-26580152AE7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "7730FD04-0CC8-4D96-A3B5-9D628381653E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D589E22C-7F87-43EF-B5FF-DC2B43E5252C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:horde:horde:3.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "57AD38FB-23DF-406D-8889-E9EB18D22C57",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen)."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de secuencia de comandos en sitios cruzados (XSS) en Horde Application Framework 3.0.0 hasta la 3.0.10 y 3.1.0 hasta la 3.1.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de uan (1) URI javascript o una URI externa (2) http, (3) https, o (4) ftp en el par\u00e1metro url en services/go.php (tambi\u00e9n conocido como dereferrer), (5) una URI javascript en el par\u00e1metro module en services/help (tambi\u00e9n conocido como el visualizador de la ayuda), y (6) el par\u00e1metro name en services/problem.php (tambi\u00e9n conocido como el problema de la pantalla de presentaci\u00f3n de informes."
    }
  ],
  "id": "CVE-2006-3548",
  "lastModified": "2026-06-16T22:27:17.187",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-07-13T00:05:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047687.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.horde.org/archives/announce/2006/000287.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.horde.org/archives/announce/2006/000288.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://moritz-naumann.com/adv/0011/hordemulti/0011.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/20954"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/21459"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27565"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/1229"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://securitytracker.com/id?1016442"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2007/dsa-1406"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.novell.com/linux/security/advisories/2006_19_sr.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/439255/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/18845"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/2694"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27589"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047687.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.horde.org/archives/announce/2006/000287.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.horde.org/archives/announce/2006/000288.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://moritz-naumann.com/adv/0011/hordemulti/0011.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/20954"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/21459"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27565"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/1229"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://securitytracker.com/id?1016442"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2007/dsa-1406"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.novell.com/linux/security/advisories/2006_19_sr.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/439255/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/18845"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/2694"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27589"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.