XSS in Horde Groupware
CVE-2012-5567
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith Calendar Application H4 before 3.0.18, as used in Horde Groupware Webmail Edition before 4.0.9, allow remote attackers to inject arbitrary web script or HTML via crafte…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.006 (70.4th percentile) — read the EPSS interpretation.
Affected products
- Horde Groupware — versions 4.0, 4.0.1, 4.0.2
- Horde Kronolith_h4 — versions 3.0, 3.0.1, 3.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- openSUSE-SU-2012:1625 (vendor-advisory, x_refsource_SUSE)
- [oss-security] 20121123 CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws (mailing-list, x_refsource_MLIST)
- [oss-security] 20121123 Re: CVE Request -- kronolith: Two sets (3.0.17 && 3.0.18) of XSS flaws (mailing-list, x_refsource_MLIST)
- 51233 (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- [announce] 20121114 Kronolith H4 (3.0.18) (final) (mailing-list, x_refsource_MLIST)
- 51469 (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM)
- 56541 (vdb-entry, x_refsource_BID)