CVE-2010-3314

Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
VendorProductVersion
egroupwareegroupware
1.4.001
egroupwareegroupware
1.4.001\+.002
egroupwareegroupware
1.4.002
egroupwareegroupware
1.6.001
egroupwareegroupware
1.6.001\+.002
egroupwareegroupware
1.6.002
egroupwareegroupware
9.1
egroupwareegroupware
9.2
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
egroupware-egw-pear
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
ignored
lucid
ignored
karmic
ignored
jaunty
ignored
hardy
dne
dapper
dne
Common Weakness Enumeration
References
http://www.debian.org/security/2010/dsa-2013
http://www.egroupware.org/news?item=93
http://www.exploit-db.com/exploits/11777/
http://www.openwall.com/lists/oss-security/2010/09/21/7
http://www.debian.org/security/2010/dsa-2013
http://www.egroupware.org/news?item=93
http://www.exploit-db.com/exploits/11777/
http://www.openwall.com/lists/oss-security/2010/09/21/7