CVE-2016-2228 Cross-site scripting (XSS) vulnerability in horde/templates/topbar/_menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to injec...
MediumCVSS 6.1
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in horde/templates/topbar/_menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter, as demonstrated by a request to xplorer/gollem/manager.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/php-horde(Debian:12) | < 5.2.9+debian0-1 | 5.2.9+debian0-1 |
| debian linux | = 8.0 | No fix listed |
| horde groupware | <= 5.2.11 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
References
- Debian Security Tracker CVE-2016-2228 vendor-advisory
- bugs.horde.org
- FEDORA-2016-3d1183830b vendor-advisory
- FEDORA-2016-5d0e7f15ef vendor-advisory
- [announce] 20160202 [announce] [SECURITY] Horde Groupware 5.2.12 (final) mailing-list vendor-advisory
- [announce] 20160202 [announce] [SECURITY] Horde Groupware Webmail Edition 5.2.12 (final) mailing-list vendor-advisory
- DSA-3497 vendor-advisory
- [oss-security] 20160206 CVE Request: Horde: Two cross-site scripting vulnerabilities mailing-list
- [oss-security] 20160206 Re: CVE Request: Horde: Two cross-site scripting vulnerabilities mailing-list
- github.com
- github.com exploit
- bugs.debian.org issue-tracking