{"id":"CVE-2009-4363","aliases":["DSA-1966-1","EUVD-2009-4331","GHSA-pjmv-2gvx-rph8"],"status":"published","title":"Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde...","description":"Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not properly handle data: URIs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via data:text/html values for the HREF attribute of an A element in an HTML e-mail message.  NOTE: the vendor states that the issue is caused by \"an XSS vulnerability in Firefox browsers.\"","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0137,"percentile":0.72115,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2009-12-21T16:00:00Z","modified":"2026-06-16T23:13:31Z","affected":[{"source":"osv","ecosystem":"Debian:4.0","package":"horde3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-4etch7"}]}],"versions":["3.1.3-4","3.1.3-4etch1","3.1.3-4etch2","3.1.3-4etch3","3.1.3-4etch4","3.1.3-4etch5","3.1.3-4etch6"],"bundled":3},{"source":"osv","ecosystem":"Debian:5.0","package":"horde3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2+debian0-2+lenny2"}]}],"bundled":3}],"products":[{"vendor":"horde","product":"application_framework"},{"vendor":"horde","product":"groupware"}],"references":[{"url":"http://marc.info/?l=horde-announce\u0026m=126100750018478\u0026w=2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch"]},{"url":"http://lists.horde.org/archives/announce/2009/000529.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch"]},{"url":"http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.559\u0026r2=1.515.2.589\u0026ty=h","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://bugs.horde.org/view.php?actionID=view_file\u0026type=patch\u0026file=0002-Bug-8715-Fix-XSS-vulnerability%5B1%5D.patch\u0026ticket=8715","tags":["x_refsource_CONFIRM","x_transferred","Exploit"]},{"url":"http://marc.info/?l=horde-announce\u0026m=126101076422179\u0026w=2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch"]},{"url":"http://bugs.horde.org/ticket/8715","tags":["x_refsource_CONFIRM","x_transferred","Exploit"]},{"url":"http://securitytracker.com/id?1023365","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4363"},{"url":"https://github.com/advisories/GHSA-pjmv-2gvx-rph8"}],"sources":{"cve":[{"id":"CVE-2009-4363","description":"Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not properly handle data: URIs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via data:text/html values for the HREF attribute of an A element in an HTML e-mail message.  NOTE: the vendor states that the issue is caused by \"an XSS vulnerability in Firefox browsers.\"","status":"published","published":"2009-12-21T16:00:00Z","modified":"2024-09-17T01:20:38.554Z","updated_at":"2026-11-02T14:33:24.451733Z"}],"euvd":[{"id":"EUVD-2009-4331","description":"Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not properly handle data: URIs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via data:text/html values for the HREF attribute of an A element in an HTML e-mail message.  NOTE: the vendor states that the issue is caused by \"an XSS vulnerability in Firefox browsers.\"","status":"published","published":"2009-12-21T16:00:00Z","modified":"2024-09-17T01:20:38Z","updated_at":"2026-11-03T00:28:50.749865Z"}],"ghsa":[{"id":"GHSA-pjmv-2gvx-rph8","title":"Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde...","description":"Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not properly handle data: URIs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via data:text/html values for the HREF attribute of an A element in an HTML e-mail message.  NOTE: the vendor states that the issue is caused by \"an XSS vulnerability in Firefox browsers.\"","status":"published","published":"2022-05-02T03:53:59Z","modified":"2023-01-31T05:09:06Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:49:29.017576Z"}],"nvd":[{"id":"CVE-2009-4363","description":"Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not properly handle data: URIs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via data:text/html values for the HREF attribute of an A element in an HTML e-mail message.  NOTE: the vendor states that the issue is caused by \"an XSS vulnerability in Firefox browsers.\"","status":"published","published":"2009-12-21T16:30:00.483Z","modified":"2026-06-16T23:13:31.567Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:01:38.33745Z"}],"osv":[{"id":"DSA-1966-1","title":"horde3 - cross-site scripting","status":"published","published":"2010-01-07T00:00:00Z","modified":"2026-03-09T01:18:20.444443Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}