CVE-2009-3701 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2009-3701 Interim 1 5 2023-12-09T02:01:39Z current 2021-05-30T12:48:51Z 2023-12-09T02:01:39Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2009-3701 Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to the PHP_SELF variable. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KMSGWTGNMZ6OBF4PSADAZBORDOW6FLX6/#KMSGWTGNMZ6OBF4PSADAZBORDOW6FLX6 E-Mail link for SUSE-SR:2010:004 https://www.suse.com/support/security/rating/ SUSE Security Ratings Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to the PHP_SELF variable. CVE-2009-3701 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N