Description
Cross-site scripting vulnerability in status.php3 for IMP 2.2.8 and HORDE 1.2.7 allows remote attackers to execute arbitrary web script and steal cookies of other IMP/HORDE users via the script parameter.
References
- http://bugs.horde.org/show_bug.cgi?id=916
- 20020406 IMP 2.2.8 (SECURITY) released mailing-list
- CSSA-2002-016.1 vendor-advisory
- DSA-126 vendor-advisory
- imp-status-php3-css(8769) vdb-entry
- 4444 vdb-entry
- 5345 vdb-entry
- CLA-2001:473 vendor-advisory