CVE-2010-0463

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-01-29 · updated 2026-06-16
Weakness: CWE-200

Description

Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.

Affected products

horde imp: through 4.3.6; 2.0, 2.2, 2.2.1, 2.2.2, 2.2.3, 2.2.4 (+34)

References

http://bugs.horde.org/ticket/8836
https://exchange.xforce.ibmcloud.com/vulnerabilities/56052
https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail
http://bugs.horde.org/ticket/8836
https://exchange.xforce.ibmcloud.com/vulnerabilities/56052
https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail

Get alerted when CVE-2010-0463 or the next vulnerability affects your stack