Read the docs
TI-2005-03935 Aliases CVE-2005-4190GHSA-22x4-mg72-m2h8

Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before…

Priority LOW 20CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.

Why it matters now

EPSS 0.01598 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:a:horde:horde_application_framework:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.2_1:*:*:*:*:*:*:*1.0.2_1VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.3_2:*:*:*:*:*:*:*1.0.3_2VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.3_3:*:*:*:*:*:*:*1.0.3_3VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.3_4:*:*:*:*:*:*:*1.0.3_4VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.5:*:*:*:*:*:*:*1.0.5VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.6:*:*:*:*:*:*:*1.0.6VulnerableHorde
  • cpe:2.3:a:horde:horde_application_framework:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.2_1:*:*:*:*:*:*:* Versions 1.0.2_1 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.3_2:*:*:*:*:*:*:* Versions 1.0.3_2 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.3_3:*:*:*:*:*:*:* Versions 1.0.3_3 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.3_4:*:*:*:*:*:*:* Versions 1.0.3_4 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.6:*:*:*:*:*:*:* Versions 1.0.6 Vulnerable ·Horde
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:horde:horde_application_framework:1.0.8:*:*:*:*:*:*:*1.0.8VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.9:*:*:*:*:*:*:*1.0.9VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.10:*:*:*:*:*:*:*1.0.10VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.0.11:*:*:*:*:*:*:*1.0.11VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.2.5:*:*:*:*:*:*:*1.2.5VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.2.7:*:*:*:*:*:*:*1.2.7VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.2.8:*:*:*:*:*:*:*1.2.8VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:1.3.4:*:*:*:*:*:*:*1.3.4VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:2.0:*:*:*:*:*:*:*2.0VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:2.1:*:*:*:*:*:*:*2.1VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:2.2:*:*:*:*:*:*:*2.2VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:2.2.4:*:*:*:*:*:*:*2.2.4VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:2.2.5:*:*:*:*:*:*:*2.2.5VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:2.2.6:*:*:*:*:*:*:*2.2.6VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:2.2.7:*:*:*:*:*:*:*2.2.7VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:2.2.8:*:*:*:*:*:*:*2.2.8VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:2.2.9:*:*:*:*:*:*:*2.2.9VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableHorde
cpe:2.3:a:horde:horde_application_framework:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableHorde
  • cpe:2.3:a:horde:horde_application_framework:1.0.8:*:*:*:*:*:*:* Versions 1.0.8 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.9:*:*:*:*:*:*:* Versions 1.0.9 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.10:*:*:*:*:*:*:* Versions 1.0.10 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.0.11:*:*:*:*:*:*:* Versions 1.0.11 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.2.5:*:*:*:*:*:*:* Versions 1.2.5 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.2.6:*:*:*:*:*:*:* Versions 1.2.6 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.2.7:*:*:*:*:*:*:* Versions 1.2.7 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.2.8:*:*:*:*:*:*:* Versions 1.2.8 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:2.2.7:*:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:2.2.9:*:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·Horde
  • cpe:2.3:a:horde:horde_application_framework:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·Horde

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-4190
  2. 2026-10-03 Alias added: GHSA-22x4-mg72-m2h8

References

Patch 1

Advisory 4

Other 1

  • TI-2014-01304 The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before… CVSS 2.0HIGH 7.5
  • TI-2007-01416 Argument injection vulnerability in the cleanup cron script in Horde Project Horde and… CVSS 2.0MEDIUM 6.8
  • TI-2015-06634 Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde… CVSS 2.0MEDIUM 6.8
  • TI-2010-03518 Cross-site request forgery (CSRF) vulnerability in the Horde Application Framework before… CVSS 2.0MEDIUM 6.8
  • TI-2007-01415 Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework… CVSS 2.0MEDIUM 4.3
  • TI-2010-02940 Cross-site scripting (XSS) vulnerability in util/icon_browser.php in the Horde… CVSS 2.0MEDIUM 4.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences