VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 17, 2009· Updated Jun 16, 2026

CVE-2009-3237

CVE-2009-3237

Description

Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebar_width parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mime_drivers.php).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

38
  • Horde (software)/Groupware26 versions
    cpe:2.3:a:horde:groupware:1.1:*:*:*:*:*:*:*+ 25 more
    • cpe:2.3:a:horde:groupware:1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.1:rc1:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.1:rc2:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.1:rc3:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.1:rc4:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.2.3:rc1:*:*:*:*:*:*
    • cpe:2.3:a:horde:groupware:1.2:rc1:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_groupware:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_groupware:1.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_groupware:1.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_groupware:1.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_groupware:1.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_groupware:1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_groupware:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_groupware:1.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_groupware:1.2.3:*:*:*:*:*:*:*
    • (no CPE)range: 1.1.x <1.1.6, 1.2.x <1.2.4
  • Horde (software)/Application Framework11 versions
    cpe:2.3:a:horde:horde_application_framework:3.2:*:*:*:*:*:*:*+ 10 more
    • cpe:2.3:a:horde:horde_application_framework:3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_application_framework:3.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_application_framework:3.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_application_framework:3.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_application_framework:3.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_application_framework:3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_application_framework:3.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_application_framework:3.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_application_framework:3.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:horde:horde_application_framework:3.3.4:*:*:*:*:*:*:*
    • (no CPE)range: 3.2.x <3.2.5, 3.3.x <3.3.5
  • Horde (software)/Groupware Webmail Editionllm-fuzzy
    Range: 1.1.x <1.1.6, 1.2.x <1.2.4

Patches

Vulnerability mechanics

References

12

News mentions

0

No linked articles in our index yet.