CVE-2010-3447

Exp

Cross-site scripting (XSS) vulnerability in view.php in the file viewer in Horde Gollem before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the file parameter in a view_file action.

Published: 2011-04-04 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2010-3447 is rated Exploit Available (59.6/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 1.79%). 4 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2010-3447

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗
— nvd_ref exploit_tag Exploit-DB ↗
— nvd_ref exploit_tag Exploit-DB ↗
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2010-3447

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.79% 1.79% +1.00%
2 2025-03-30 0.72% 0.79% +0.07%
3 2025-03-29 — 0.72% —

Full EPSS history (8 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2010-3447

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
4.3 2.0 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:N)
No availability impact.
 8.6 2.9 [email protected]

Weakness enumeration for CVE-2010-3447

OS Trackers for CVE-2010-3447

vendor priority summary link
ubuntu medium CVE-2010-3447 medium priority: Ubuntu including 1 source packages (gollem), 19 status rows across 19 suites (dapper, hardy, karmic, lucid, maverick, natty, oneiric, precise, quantal, raring, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): DNE 10, ignored 8, released 1. https://ubuntu.com/security/CVE-2010-3447

Affected software / configurations for CVE-2010-3447

Vendor Product Version Raw CPE
horde gollem <= 1.1.1 cpe:2.3:a:horde:gollem:*:*:*:*:*:*:*:*
horde gollem 1.0 cpe:2.3:a:horde:gollem:1.0:*:*:*:*:*:*:*
horde gollem 1.0 cpe:2.3:a:horde:gollem:1.0:alpha:*:*:*:*:*:*
horde gollem 1.0 cpe:2.3:a:horde:gollem:1.0:beta:*:*:*:*:*:*
horde gollem 1.0 cpe:2.3:a:horde:gollem:1.0:rc1:*:*:*:*:*:*
horde gollem 1.0 cpe:2.3:a:horde:gollem:1.0:rc2:*:*:*:*:*:*
horde gollem 1.0.1 cpe:2.3:a:horde:gollem:1.0.1:*:*:*:*:*:*:*
horde gollem 1.0.1 cpe:2.3:a:horde:gollem:1.0.1:rc1:*:*:*:*:*:*
horde gollem 1.0.2 cpe:2.3:a:horde:gollem:1.0.2:*:*:*:*:*:*:*
horde gollem 1.0.2 cpe:2.3:a:horde:gollem:1.0.2:rc1:*:*:*:*:*:*
horde gollem 1.0.3 cpe:2.3:a:horde:gollem:1.0.3:*:*:*:*:*:*:*
horde gollem 1.0.4 cpe:2.3:a:horde:gollem:1.0.4:*:*:*:*:*:*:*
horde gollem 1.1 cpe:2.3:a:horde:gollem:1.1:*:*:*:*:*:*:*
horde gollem 1.1 cpe:2.3:a:horde:gollem:1.1:rc1:*:*:*:*:*:*

References for CVE-2010-3447

URL Tags
http://bugs.horde.org/ticket/9191 Exploit Patch
http://git.horde.org/diff.php/gollem/view.php?rt=horde&r1=1.51.2.6&r2=1.51.2.7&ty=u Patch
http://git.horde.org/diff.php/gollem/view.php?rt=horde-git&r1=7f7a4300f16b429ed645bc3e2af2cedffc70ce3e&r2=025a1bfbe69622036f8e3a27a6edd39c02dcd4ea Patch
http://lists.horde.org/archives/announce/2010/000565.html Patch
http://lists.horde.org/archives/commits/2010-August/004747.html Patch
http://openwall.com/lists/oss-security/2010/09/29/11 Exploit Patch
http://openwall.com/lists/oss-security/2010/09/30/5 Exploit Patch
http://openwall.com/lists/oss-security/2010/09/30/7 Exploit Patch
http://openwall.com/lists/oss-security/2010/09/30/8 Patch
http://secunia.com/advisories/41624 Vendor Advisory
http://www.osvdb.org/68262
http://www.vupen.com/english/advisories/2010/2523 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/62091
cvelogic Threat Intelligence