CVE-2006-3549

Published: Jul 13, 2006Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server.

Affected (13)

Products: Horde: Horde Application Framework

1 product

Horde Application Framework

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Horde Horde Application Framework	Version 3.0.0
Horde Horde Application Framework	Version 3.0.10
Horde Horde Application Framework	Version 3.0.1
Horde Horde Application Framework	Version 3.0.2
Horde Horde Application Framework	Version 3.0.3
Horde Horde Application Framework	Version 3.0.4
Horde Horde Application Framework	Version 3.0.5
Horde Horde Application Framework	Version 3.0.6
Horde Horde Application Framework	Version 3.0.7
Horde Horde Application Framework	Version 3.0.8
Horde Horde Application Framework	Version 3.0.9
Horde Horde Application Framework	Version 3.1.0
Horde Horde Application Framework	Version 3.1.1

References (26)

http://lists.horde.org/archives/announce/2006/000287.html

Source: cve@mitre.org

Patch

http://lists.horde.org/archives/announce/2006/000288.html

Source: cve@mitre.org

http://moritz-naumann.com/adv/0011/hordemulti/0011.txt

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/20954

Source: cve@mitre.org

http://secunia.com/advisories/21459

Source: cve@mitre.org

http://secunia.com/advisories/27565

Source: cve@mitre.org

http://securityreason.com/securityalert/1229

Source: cve@mitre.org

http://securitytracker.com/id?1016442

Source: cve@mitre.org

Exploit

http://www.debian.org/security/2007/dsa-1406

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2006_19_sr.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/439255/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/18845

Source: cve@mitre.org

Exploit

http://www.vupen.com/english/advisories/2006/2694

Source: cve@mitre.org

http://lists.horde.org/archives/announce/2006/000287.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.horde.org/archives/announce/2006/000288.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://moritz-naumann.com/adv/0011/hordemulti/0011.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://secunia.com/advisories/20954

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/21459

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/27565

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/1229

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1016442

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.debian.org/security/2007/dsa-1406

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.novell.com/linux/security/advisories/2006_19_sr.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/439255/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/18845

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.vupen.com/english/advisories/2006/2694

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.