{"id":"CVE-2006-3549","state":"PUBLISHED","title":"services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to ","description":"services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform \"Web tunneling\" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server.","publishedAt":"2006-07-13T00:00:00.000Z","updatedAt":"2024-08-07T18:30:34.374Z","severity":null,"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["http://lists.horde.org/archives/announce/2006/000287.html","http://www.securityfocus.com/bid/18845","http://www.vupen.com/english/advisories/2006/2694","http://secunia.com/advisories/21459","http://www.novell.com/linux/security/advisories/2006_19_sr.html","http://secunia.com/advisories/27565","http://securitytracker.com/id?1016442","http://lists.horde.org/archives/announce/2006/000288.html","http://securityreason.com/securityalert/1229","http://moritz-naumann.com/adv/0011/hordemulti/0011.txt","http://www.debian.org/security/2007/dsa-1406","http://secunia.com/advisories/20954","http://www.securityfocus.com/archive/1/439255/100/0/threaded"],"weaknesses":[],"ingestedAt":"2026-10-29T19:27:47.576Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2006/3xxx/CVE-2006-3549.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2006-3549","state":"PUBLISHED","datePublished":"2006-07-13T00:00:00.000Z","dateUpdated":"2024-08-07T18:30:34.374Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2006-07-12T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform \"Web tunneling\" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"http://lists.horde.org/archives/announce/2006/000287.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/18845","name":"18845","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.vupen.com/english/advisories/2006/2694","name":"ADV-2006-2694","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/21459","name":"21459","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.novell.com/linux/security/advisories/2006_19_sr.html","name":"SUSE-SR:2006:019","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://secunia.com/advisories/27565","name":"27565","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://securitytracker.com/id?1016442","name":"1016442","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.horde.org/archives/announce/2006/000288.html","tags":["x_refsource_CONFIRM"]},{"url":"http://securityreason.com/securityalert/1229","name":"1229","tags":["third-party-advisory","x_refsource_SREASON"]},{"url":"http://moritz-naumann.com/adv/0011/hordemulti/0011.txt","tags":["x_refsource_MISC"]},{"url":"http://www.debian.org/security/2007/dsa-1406","name":"DSA-1406","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://secunia.com/advisories/20954","name":"20954","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/439255/100/0/threaded","name":"20060705 Public Advisory: Horde 3.1.1, 3.0.10 Multiple Security Issues","tags":["mailing-list","x_refsource_BUGTRAQ"]}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"mitre","dateUpdated":"2018-10-18T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca"},"datePublic":"2006-07-05T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-3549","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform \"Web tunneling\" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://lists.horde.org/archives/announce/2006/000287.html","refsource":"CONFIRM","url":"http://lists.horde.org/archives/announce/2006/000287.html"},{"name":"18845","refsource":"BID","url":"http://www.securityfocus.com/bid/18845"},{"name":"ADV-2006-2694","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/2694"},{"name":"21459","refsource":"SECUNIA","url":"http://secunia.com/advisories/21459"},{"name":"SUSE-SR:2006:019","refsource":"SUSE","url":"http://www.novell.com/linux/security/advisories/2006_19_sr.html"},{"name":"27565","refsource":"SECUNIA","url":"http://secunia.com/advisories/27565"},{"name":"1016442","refsource":"SECTRACK","url":"http://securitytracker.com/id?1016442"},{"name":"http://lists.horde.org/archives/announce/2006/000288.html","refsource":"CONFIRM","url":"http://lists.horde.org/archives/announce/2006/000288.html"},{"name":"1229","refsource":"SREASON","url":"http://securityreason.com/securityalert/1229"},{"name":"http://moritz-naumann.com/adv/0011/hordemulti/0011.txt","refsource":"MISC","url":"http://moritz-naumann.com/adv/0011/hordemulti/0011.txt"},{"name":"DSA-1406","refsource":"DEBIAN","url":"http://www.debian.org/security/2007/dsa-1406"},{"name":"20954","refsource":"SECUNIA","url":"http://secunia.com/advisories/20954"},{"name":"20060705 Public Advisory: Horde 3.1.1, 3.0.10 Multiple Security Issues","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/439255/100/0/threaded"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://lists.horde.org/archives/announce/2006/000287.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/18845","name":"18845","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2006/2694","name":"ADV-2006-2694","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://secunia.com/advisories/21459","name":"21459","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.novell.com/linux/security/advisories/2006_19_sr.html","name":"SUSE-SR:2006:019","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://secunia.com/advisories/27565","name":"27565","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://securitytracker.com/id?1016442","name":"1016442","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://lists.horde.org/archives/announce/2006/000288.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://securityreason.com/securityalert/1229","name":"1229","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"]},{"url":"http://moritz-naumann.com/adv/0011/hordemulti/0011.txt","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.debian.org/security/2007/dsa-1406","name":"DSA-1406","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://secunia.com/advisories/20954","name":"20954","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/439255/100/0/threaded","name":"20060705 Public Advisory: Horde 3.1.1, 3.0.10 Multiple Security Issues","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-07T18:30:34.374Z"}}]}}}