Actu
Vigil@nce: Horde, Cross Site Scripting via style
December 2008 by Vigil@nce
SYNTHESIS
An attacker can use the "style" attribute in order to create a
Cross Site Scripting if the victim uses Internet Explorer.
Gravity: 2/4
Consequences: client access/rights
Provenance: document
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 10/12/2008
IMPACTED PRODUCTS
– Unix - plateform
DESCRIPTION
In HTML, the "style" attribute defines the style to apply to the
current object. For example:
invalid:
However, Horde does not filter this special case.
An attacker can therefore use the "style" attribute in order to
create a Cross Site Scripting if the victim uses Internet Explorer.
CHARACTERISTICS
Identifiers: VIGILANCE-VUL-8322
