Description
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | horde3 | 3.0.4-4sarge3 | DSA-1033-1 |
Advisories 1
- DSA-1033-1 horde3 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 15810 vdb-entry
- 15806 vdb-entry
- 15808 vdb-entry
- ADV-2005-2835 vdb-entry
- 15804 vdb-entry
- 15803 vdb-entry
- 19619 third-party-advisory
- DSA-1033 vendor-advisory
- SUSE-SR:2006:016 vendor-advisory
- 15802 vdb-entry
- 17970 third-party-advisory
- 20960 third-party-advisory
- http://www.sec-consult.com/245.html
- [horde-announce] 20051211 Horde 3.0.8 (final) mailing-list
- 19897 third-party-advisory
- SUSE-SR:2006:009 vendor-advisory