CVE-2015-8807 Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webm...
MediumCVSS 6.1
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/php-horde-core(Debian:12) | < 2.22.4+debian0-1 | 2.22.4+debian0-1 |
| debian/php-horde-core(Debian:12) | = 1.8.3-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 1.8.3-1.1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.0.4-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.1-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.3-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.4-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.4-2 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.1.5-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.10.1-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.10.2-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.11.1+dfsg0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.11.1-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.11.1-2 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.4.3-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.5.0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.6.0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.6.6-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.7.0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.8.0-1 | No fix listed |
| debian/php-horde-core(Debian:12) | = 2.9.0-1 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| horde groupware | = 5.2.11 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-8807 vendor-advisory
- FEDORA-2016-3d1183830b vendor-advisory
- FEDORA-2016-5d0e7f15ef vendor-advisory
- [announce] 20160202 [announce] [SECURITY] Horde Groupware 5.2.12 (final) mailing-list vendor-advisory
- [announce] 20160202 [announce] [SECURITY] Horde Groupware Webmail Edition 5.2.12 (final) mailing-list vendor-advisory
- DSA-3496 vendor-advisory
- [oss-security] 20160206 CVE Request: Horde: Two cross-site scripting vulnerabilities mailing-list
- [oss-security] 20160206 Re: CVE Request: Horde: Two cross-site scripting vulnerabilities mailing-list
- github.com exploit
- github.com
- bugs.debian.org issue-tracking