CVE-2012-5565 Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to i...
MediumCVSS 4.3
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in js/compose-dimp.js in Horde Internet Mail Program (IMP) before 5.0.24, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted name for an attached file, related to the dynamic view.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| horde imp | <= 5.0.23 | No fix listed |
| horde imp | = 5.0.4 | No fix listed |
| horde imp | = 5.0.5 | No fix listed |
| horde imp | = 5.0.6 | No fix listed |
| horde imp | = 5.0.7 | No fix listed |
| horde imp | = 5.0.8 | No fix listed |
| horde imp | = 5.0.9 | No fix listed |
| horde imp | = 5.0.10 | No fix listed |
| horde imp | = 5.0.11 | No fix listed |
| horde imp | = 5.0.12 | No fix listed |
| horde imp | = 5.0.13 | No fix listed |
| horde imp | = 5.0.14 | No fix listed |
| horde imp | = 5.0.15 | No fix listed |
| horde imp | = 5.0.16 | No fix listed |
| horde imp | = 5.0.17 | No fix listed |
| horde imp | = 5.0.18 | No fix listed |
| horde imp | = 5.0.19 | No fix listed |
| horde imp | = 5.0.20 | No fix listed |
| horde imp | = 5.0.21 | No fix listed |
| horde imp | = 5.0.22 | No fix listed |
| horde groupware | <= 4.0.8 | No fix listed |
| horde groupware | = 4.0 | No fix listed |
| horde groupware | = 4.0-rc1 | No fix listed |
| horde groupware | = 4.0-rc2 | No fix listed |
| horde groupware | = 4.0.1 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| horde groupware | = 4.0.2 | No fix listed |
| horde groupware | = 4.0.3 | No fix listed |
| horde groupware | = 4.0.4 | No fix listed |
| horde groupware | = 4.0.5 | No fix listed |
| horde groupware | = 4.0.6 | No fix listed |
| horde groupware | = 4.0.7 | No fix listed |
References
- [announce] 20121114 IMP H4 (5.0.24) (final) mailing-list
- [announce] 20121114 Horde Groupware Webmail Edition 4.0.9 (final) mailing-list vendor-advisory
- openSUSE-SU-2012:1626 vendor-advisory
- [oss-security] 20121123 Re: CVE Request -- (Horde) IMP (prior v5.0.24-git): Obscure XSS issue when uploading attachments. mailing-list
- github.com
- Debian Security Tracker CVE-2012-5565 vendor-advisory