CVE-2016-6191 Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Descr...
MediumCVSS 6.1
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Description, (2) Location, (3) URL, or (4) Title field.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sogo(Debian:12) | < 3.2.4-0.2 | 3.2.4-0.2 |
| debian/sogo(Debian:13) | < 3.2.4-0.2 | 3.2.4-0.2 |
| alinto sogo | <= 3.1.2 | No fix listed |
References
- Debian Security Tracker CVE-2016-6191 vendor-advisory
- [oss-security] 20160709 Re: CVE request: several SOGo issues (DOS, XSS, information leakage) mailing-list patch vdb-entry
- github.com patch
- sogo.nu vendor-advisory