CVE-2006-3549

services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform Web tunneling attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server.

Affected Software

Name	Vendor	Start Version	End Version
Horde_application_framework	Horde	3.0.0 (including)	3.0.0 (including)
Horde_application_framework	Horde	3.0.1 (including)	3.0.1 (including)
Horde_application_framework	Horde	3.0.2 (including)	3.0.2 (including)
Horde_application_framework	Horde	3.0.3 (including)	3.0.3 (including)
Horde_application_framework	Horde	3.0.4 (including)	3.0.4 (including)
Horde_application_framework	Horde	3.0.5 (including)	3.0.5 (including)
Horde_application_framework	Horde	3.0.6 (including)	3.0.6 (including)
Horde_application_framework	Horde	3.0.7 (including)	3.0.7 (including)
Horde_application_framework	Horde	3.0.8 (including)	3.0.8 (including)
Horde_application_framework	Horde	3.0.9 (including)	3.0.9 (including)
Horde_application_framework	Horde	3.0.10 (including)	3.0.10 (including)
Horde_application_framework	Horde	3.1.0 (including)	3.1.0 (including)
Horde_application_framework	Horde	3.1.1 (including)	3.1.1 (including)
Horde3	Ubuntu	dapper	*
Horde3	Ubuntu	devel	*
Horde3	Ubuntu	edgy	*
Horde3	Ubuntu	feisty	*
Horde3	Ubuntu	gutsy	*
Horde3	Ubuntu	hardy	*
Horde3	Ubuntu	intrepid	*
Horde3	Ubuntu	jaunty	*
Horde3	Ubuntu	karmic	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2006-3549
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References