CVE-2006-3549 Server-side request forgery in n/a
Remote attackers can use the Horde image proxy to tunnel web traffic and access internal resources via crafted URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-3549?
CVE-2006-3549 is a medium-severity server-side request forgery vulnerability in n/a, published on 13 Jul 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server.
Which versions are affected by CVE-2006-3549?
It affects 1 product.
Products include Horde Horde Application Framework.
How do I fix CVE-2006-3549?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2006-3549 being exploited?
There is no known exploitation of CVE-2006-3549 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2014-1691 The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object inject
- CVE-2010-3694 Cross-site request forgery in n/a
- CVE-2007-1474 Command injection in n/a
- CVE-2010-3077 Cross-site scripting in n/a
- CVE-2007-1473 Cross-site scripting in n/a
Sources
Also known as GHSA-3w95-3q7c-6v47.