mailing list archives
Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues
From: Moritz Naumann <security () moritz-naumann com>
Date: Thu, 15 Mar 2007 02:00:33 +0100
-----BEGIN PGP SIGNED MESSAGE-----
Horde IMP Webmail Client version H3 (4.1.4) was released a few hours
ago. It contains fixes for 2 XSS issues (compared to 4.1.4 RC1).
1. Script injection through email subject lines in threaded view
Subject lines of emails, when displayed in vulnerable versions of IMP in
'multiple message view' (IMP core) or with the thread plugin, are not
An email with a custom crafted subject which may then be loaded in the
authenticated webmail session of the victim may inject malicious client
The issue is found in thread.php.
2. Multiple XSS in search function
A victims' web browser, running a previously authenticated IMP session,
may be forced into loading a custom crafted URL pointing to the email
search function. The payload will cause the client side script code
contained in the specially crafted URL to be executed in the security
context of the domain the vulnerable copy of IMP is accessed through.
This allows for mounting XSS attacks.
There were several XSS issues in the search function which have been
fixed at the same time.
Credit for discovering both issues and providing a patch for the first
one goes to
Immerda Project Group
The developers' release announcement can be found at:
General information on this application is available at
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
-----END PGP SIGNATURE-----
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Horde IMP Webmail Client version H3 (4.1.4) fixes multiple XSS issues Moritz Naumann (Mar 15)