Vulnerability CVE-2005-4189
Published: 2005-12-13   Modified: 2012-02-12

Description:
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Calendar name field when creating calendars, (2) event title field when deleting events, the (3) Category and (4) Location search fields, and the (5) attendees email address fields when editing event attendees, and possibly other vectors.

CVSS2 => (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Horde -> Kronolith h3 

 References:
http://www.securityfocus.com/bid/15808
http://www.osvdb.org/21611
http://www.osvdb.org/21610
http://www.osvdb.org/21609
http://www.osvdb.org/21608
http://secunia.com/advisories/17971
http://lists.horde.org/archives/announce/2005/000234.html
http://www.vupen.com/english/advisories/2005/2834
http://www.sec-consult.com/245.html
http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0459.html
http://www.debian.org/security/2006/dsa-970
http://secunia.com/advisories/18827
Copyright 2024, cxsecurity.com

 

Back to Top