This host is installed Horde Webmail and is prone to open redirect vulnerability.

Successful exploitation will allow remote attackers to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Impact Level: Application

No solution or patch is available as of 20th February, 2015. Information regarding this issue will be updated once the solution details are available. For updates refer to http://www.horde.org/apps/webmail

The flaw exists because the application does not validate the 'url' parameter upon submission to the /horde/util/go.php script.

Horde Webmail version 5.1 and prior

Send a crafted HTTP GET request and check whether it redirects to the malicious websites.

• http://osvdb.org/105366
• http://packetstormsecurity.com/files/125953
• http://www.exploit-db.com/exploits/32638

---

Updated on 2015-03-25