Description
Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) kp3, (2) type, (3) msg, (4) forum_id, (5) pos, (6) cats_app, (7) cat_id, (8) msgball[msgnum], (9) fldball[acctnum] parameters to index.php or (10) ticket_id to viewticket_details.php.
Product(s):
- PhpGroupWare 0.9.12
- PhpGroupWare 0.9.13
- PhpGroupWare 0.9.14.003
- PhpGroupWare 0.9.14.005
- PhpGroupWare 0.9.14.006
- PhpGroupWare 0.9.14.007
- PhpGroupWare 0.9.14
- PhpGroupWare 0.9.16.000
- PhpGroupWare 0.9.16.002
- PhpGroupWare 0.9.16.003
- PhpGroupWare 0.9.16 RC1
Question to Ask Vendors:
- Can you confirm whether your systems are affected by CVE-2004-1384, and if so, what steps are you currently taking to mitigate this vulnerability?
- What is your estimated timeline for fully resolving CVE-2004-1384 in your products or services, and how will you communicate updates on this issue to us as your customer?
Recommended Actions:
- Check out the advisory links provided below.