Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in…
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) phpshell.php, (2) cmdshell.php, or (3) sqlshell.php in admin/, related to the PHP_SELF variable.
Why it matters now
EPSS 0.04832 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 61
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:horde:application_framework:*:*:*:*:*:*:*:* | up to 3.3.5 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:2.1:*:*:*:*:*:*:* | 2.1 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:2.1.3:*:*:*:*:*:*:* | 2.1.3 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:2.2.1:*:*:*:*:*:*:* | 2.2.1 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:2.2.3:*:*:*:*:*:*:* | 2.2.3 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:2.2.4:*:*:*:*:*:*:* | 2.2.4 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:2.2.4_rc1:*:*:*:*:*:*:* | 2.2.4_rc1 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:2.2.5:*:*:*:*:*:*:* | 2.2.5 | Vulnerable | Horde |
- cpe:2.3:a:horde:application_framework:*:*:*:*:*:*:*:* Versions up to 3.3.5 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:2.2.4_rc1:*:*:*:*:*:*:* Versions 2.2.4_rc1 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·Horde
Show 51 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:horde:application_framework:2.2.6:*:*:*:*:*:*:* | 2.2.6 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.0.1:*:*:*:*:*:*:* | 3.0.1 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.0.2:*:*:*:*:*:*:* | 3.0.2 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.0.3:*:*:*:*:*:*:* | 3.0.3 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.0.4:*:*:*:*:*:*:* | 3.0.4 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.0.6:*:*:*:*:*:*:* | 3.0.6 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.0.7:*:*:*:*:*:*:* | 3.0.7 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.0.8:*:*:*:*:*:*:* | 3.0.8 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.0.9:*:*:*:*:*:*:* | 3.0.9 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.1.1:*:*:*:*:*:*:* | 3.1.1 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.2:*:*:*:*:*:*:* | 3.2 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.2.1:*:*:*:*:*:*:* | 3.2.1 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.2.2:*:*:*:*:*:*:* | 3.2.2 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.2.3:*:*:*:*:*:*:* | 3.2.3 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.2.4:*:*:*:*:*:*:* | 3.2.4 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.3:*:*:*:*:*:*:* | 3.3 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.3.1:*:*:*:*:*:*:* | 3.3.1 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.3.2:*:*:*:*:*:*:* | 3.3.2 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.3.3:*:*:*:*:*:*:* | 3.3.3 | Vulnerable | Horde |
| cpe:2.3:a:horde:application_framework:3.3.4:*:*:*:*:*:*:* | 3.3.4 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:*:*:*:*:*:*:*:* | up to 1.2.4 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.0.1:*:*:*:*:*:*:* | 1.0.1 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.0.2:*:*:*:*:*:*:* | 1.0.2 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.0.3:*:*:*:*:*:*:* | 1.0.3 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.0.4:*:*:*:*:*:*:* | 1.0.4 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.0.5:*:*:*:*:*:*:* | 1.0.5 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.1:*:*:*:*:*:*:* | 1.1 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.1.1:*:*:*:*:*:*:* | 1.1.1 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.1.2:*:*:*:*:*:*:* | 1.1.2 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.1.3:*:*:*:*:*:*:* | 1.1.3 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.1.4:*:*:*:*:*:*:* | 1.1.4 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.1.5:*:*:*:*:*:*:* | 1.1.5 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.2:*:*:*:*:*:*:* | 1.2 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.2:rc1:*:*:*:*:*:* | 1.2 rc1 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.2.1:*:*:*:*:*:*:* | 1.2.1 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.2.2:*:*:*:*:*:*:* | 1.2.2 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.2.3:*:*:*:*:*:*:* | 1.2.3 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.0:rc1:*:*:*:*:*:* | 1.0 rc1 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.0:rc2:*:*:*:*:*:* | 1.0 rc2 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.0.6:*:*:*:*:*:*:* | 1.0.6 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.0.7:*:*:*:*:*:*:* | 1.0.7 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.0.8:*:*:*:*:*:*:* | 1.0.8 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.1:rc1:*:*:*:*:*:* | 1.1 rc1 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.1:rc2:*:*:*:*:*:* | 1.1 rc2 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.1:rc3:*:*:*:*:*:* | 1.1 rc3 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.1:rc4:*:*:*:*:*:* | 1.1 rc4 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.1.6:*:*:*:*:*:*:* | 1.1.6 | Vulnerable | Horde |
| cpe:2.3:a:horde:groupware:1.2.3:rc1:*:*:*:*:*:* | 1.2.3 rc1 | Vulnerable | Horde |
- cpe:2.3:a:horde:application_framework:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.0.8:*:*:*:*:*:*:* Versions 3.0.8 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.0.9:*:*:*:*:*:*:* Versions 3.0.9 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.3.1:*:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.3.2:*:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.3.3:*:*:*:*:*:*:* Versions 3.3.3 Vulnerable ·Horde
- cpe:2.3:a:horde:application_framework:3.3.4:*:*:*:*:*:*:* Versions 3.3.4 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:*:*:*:*:*:*:*:* Versions up to 1.2.4 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.2:rc1:*:*:*:*:*:* Versions 1.2 rc1 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.0:rc1:*:*:*:*:*:* Versions 1.0 rc1 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.0:rc2:*:*:*:*:*:* Versions 1.0 rc2 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.0.6:*:*:*:*:*:*:* Versions 1.0.6 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.0.7:*:*:*:*:*:*:* Versions 1.0.7 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.0.8:*:*:*:*:*:*:* Versions 1.0.8 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.1:rc1:*:*:*:*:*:* Versions 1.1 rc1 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.1:rc2:*:*:*:*:*:* Versions 1.1 rc2 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.1:rc3:*:*:*:*:*:* Versions 1.1 rc3 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.1:rc4:*:*:*:*:*:* Versions 1.1 rc4 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.1.6:*:*:*:*:*:*:* Versions 1.1.6 Vulnerable ·Horde
- cpe:2.3:a:horde:groupware:1.2.3:rc1:*:*:*:*:*:* Versions 1.2.3 rc1 Vulnerable ·Horde
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2009-3701
- 2026-10-03 Alias added: GHSA-pfm3-37qv-rm2q
References
Patch 4
More Horde Application Framework vulnerabilities
- TI-2006-01444 Eval injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10… CVSS 2.0HIGH 7.5
- TI-2009-03081 The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5… CVSS 2.0MEDIUM 4.3
- TI-2006-04111 index.php in Horde Application Framework before 3.1.2 allows remote attackers to include… CVSS 2.0MEDIUM 4.3
- TI-2009-04126 Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6… CVSS 2.0MEDIUM 4.3
- TI-2008-05613 Cross-site scripting (XSS) vulnerability in the XSS filter… CVSS 2.0MEDIUM 4.3
- TI-2005-00901 Cross-site scripting (XSS) vulnerability in Horde 3.0.4 before 3.0.4-RC2 allows remote… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2009-3701 · CVE Program
- CVE-2009-3701 · NVD
- FIRST EPSS
- GHSA-pfm3-37qv-rm2q · GitHub Advisory Database · CC BY 4.0
- CVE-2009-3701 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences