Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/

SYNTHESIS OF THE VULNERABILITY

An attacker can send a vCard containing a malicious field, in
order to create a Cross Site Scripting in Horde applications.

Severity: 2/4

Creation date: 23/11/2010

DESCRIPTION OF THE VULNERABILITY
A visit card in vCard format contains several fields:
– field N : name
– field FN : full name
– field TEL : phone number
– etc.

They can be shared via email.

The MIME/MIME/Viewer/Attic/vcard.php and Core/lib/Horde/Core/Mime/Viewer/Vcard.php
files display vCards. However, the FN field is not filtered before
being displayed.

An attacker can therefore send a vCard containing a malicious
field, in order to create a Cross Site Scripting in Horde
applications.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Horde-Cross-Site-Scripting-via-vCard-10146